How to generate a UUID in JavaScript & Node.js

In 2026 you rarely need an npm package for this: crypto.randomUUID() is built into every modern browser, Node.js, Deno, and Bun, and returns a random UUID v4 in one call. All snippets below were run on Node.js 23.

The zero-dependency answer

// Browser, Node.js 14.17+, Deno, Bun — no import needed
const id = crypto.randomUUID();
// "8f76cd82-a66e-41b9-b47b-9b2e55f1bb24"

That's it. It is cryptographically secure, always lowercase, and always version 4. Before reaching for npm install uuid, check the support table:

Where crypto.randomUUID() works

RuntimeSupported sinceNote
Chrome / Edge92 (2021)HTTPS or localhost only (secure context)
Firefox95 (2021)Secure context only
Safari15.4 (2022)Secure context only
Node.js14.17 / global since 19Older Node: require("crypto").randomUUID()
Deno / BunFrom 1.xGlobal

The classic gotcha: on a plain http:// page (not localhost), crypto.randomUUID is undefined — the spec restricts it to secure contexts.

When you still need the uuid package

Three cases justify npm install uuid:

import { v7 as uuidv7, v5 as uuidv5, validate, version } from "uuid";

// 1. UUID v7 — time-ordered, ideal for database keys
uuidv7();      // "01a0176b-aac4-70a3-9b9b-89e561ddee46" (sortable)

// 2. UUID v5 — deterministic, same input → same UUID
uuidv5("example.com", "6ba7b810-9dad-11d1-80b4-00c04fd430c8");
               // always "cfbff0d1-9375-5685-968c-48ce8b15ae17"

// 3. Validation helpers
validate("550e8400-e29b-41d4-a716-446655440000");  // true
validate("not-a-uuid");                             // false
version("550e8400-e29b-41d4-a716-446655440000");   // 4

If your UUIDs become database primary keys, prefer v7 over v4 — see UUID v4 vs v7 for why time-ordered keys keep indexes fast.

Validating without a dependency

const UUID_RE =
  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;

UUID_RE.test("550e8400-e29b-41d4-a716-446655440000"); // true

TypeScript tip: a branded UUID type

type UUID = string & { readonly __brand: "UUID" };

function newId(): UUID {
  return crypto.randomUUID() as UUID;
}
// Now a plain string can't be passed where a UUID is expected.

TypeScript 5+ also types crypto.randomUUID() as `${string}-${string}-${string}-${string}-${string}`, which catches some obvious mistakes at compile time.

Frequently asked questions

Do I need the npm uuid package to generate a UUID?

Usually not. crypto.randomUUID() is built into all modern browsers, Node.js 14.17+, Deno, and Bun, and generates a UUID v4 with no dependency. Install the uuid package only when you need v7, v5/v3, or validation helpers.

Why is crypto.randomUUID undefined in my browser?

It is only exposed in secure contexts — pages served over HTTPS or from localhost. On a plain http:// page the function does not exist. Serve over HTTPS or test on localhost.

Is crypto.randomUUID() cryptographically secure?

Yes. It is defined by the Web Crypto specification to use a cryptographically secure random number generator, the same source as crypto.getRandomValues().

How do I validate a UUID string in JavaScript?

Use validate() and version() from the uuid package, or a regex for zero dependencies. validate('550e8400-e29b-41d4-a716-446655440000') returns true.

Need a batch of UUIDs without writing code? Our free UUID generator creates up to 1,000 at once — v1/v3/v4/v5/v7, entirely in your browser. Also in this series: UUID in Python.