How to generate a UUID in JavaScript & Node.js
In 2026 you rarely need an npm package for this: crypto.randomUUID() is built into every modern browser, Node.js, Deno, and Bun, and returns a random UUID v4 in one call. All snippets below were run on Node.js 23.
The zero-dependency answer
// Browser, Node.js 14.17+, Deno, Bun — no import needed const id = crypto.randomUUID(); // "8f76cd82-a66e-41b9-b47b-9b2e55f1bb24"
That's it. It is cryptographically secure, always lowercase, and always version 4. Before reaching for npm install uuid, check the support table:
Where crypto.randomUUID() works
| Runtime | Supported since | Note |
|---|---|---|
| Chrome / Edge | 92 (2021) | HTTPS or localhost only (secure context) |
| Firefox | 95 (2021) | Secure context only |
| Safari | 15.4 (2022) | Secure context only |
| Node.js | 14.17 / global since 19 | Older Node: require("crypto").randomUUID() |
| Deno / Bun | From 1.x | Global |
The classic gotcha: on a plain http:// page (not localhost), crypto.randomUUID is undefined — the spec restricts it to secure contexts.
When you still need the uuid package
Three cases justify npm install uuid:
import { v7 as uuidv7, v5 as uuidv5, validate, version } from "uuid";
// 1. UUID v7 — time-ordered, ideal for database keys
uuidv7(); // "01a0176b-aac4-70a3-9b9b-89e561ddee46" (sortable)
// 2. UUID v5 — deterministic, same input → same UUID
uuidv5("example.com", "6ba7b810-9dad-11d1-80b4-00c04fd430c8");
// always "cfbff0d1-9375-5685-968c-48ce8b15ae17"
// 3. Validation helpers
validate("550e8400-e29b-41d4-a716-446655440000"); // true
validate("not-a-uuid"); // false
version("550e8400-e29b-41d4-a716-446655440000"); // 4If your UUIDs become database primary keys, prefer v7 over v4 — see UUID v4 vs v7 for why time-ordered keys keep indexes fast.
Validating without a dependency
const UUID_RE =
/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
UUID_RE.test("550e8400-e29b-41d4-a716-446655440000"); // trueTypeScript tip: a branded UUID type
type UUID = string & { readonly __brand: "UUID" };
function newId(): UUID {
return crypto.randomUUID() as UUID;
}
// Now a plain string can't be passed where a UUID is expected.TypeScript 5+ also types crypto.randomUUID() as `${string}-${string}-${string}-${string}-${string}`, which catches some obvious mistakes at compile time.
Frequently asked questions
Do I need the npm uuid package to generate a UUID?
Usually not. crypto.randomUUID() is built into all modern browsers, Node.js 14.17+, Deno, and Bun, and generates a UUID v4 with no dependency. Install the uuid package only when you need v7, v5/v3, or validation helpers.
Why is crypto.randomUUID undefined in my browser?
It is only exposed in secure contexts — pages served over HTTPS or from localhost. On a plain http:// page the function does not exist. Serve over HTTPS or test on localhost.
Is crypto.randomUUID() cryptographically secure?
Yes. It is defined by the Web Crypto specification to use a cryptographically secure random number generator, the same source as crypto.getRandomValues().
How do I validate a UUID string in JavaScript?
Use validate() and version() from the uuid package, or a regex for zero dependencies. validate('550e8400-e29b-41d4-a716-446655440000') returns true.
Need a batch of UUIDs without writing code? Our free UUID generator creates up to 1,000 at once — v1/v3/v4/v5/v7, entirely in your browser. Also in this series: UUID in Python.