How to Generate a UUID in JavaScript, Python and SQL

crypto.randomUUID();
// "7e338c66-c54b-426e-b18a-030cb358d321"

crypto.randomUUID() returns a random version 4 UUID, built from a cryptographically secure random source. It is available in Node and in all current browsers, with one condition in the browser: the page must be served over HTTPS or from localhost, because the function only exists in secure contexts.

Version 7 puts a millisecond timestamp in the first 48 bits, so IDs created later sort later, which keeps database indexes compact. There is no built-in function for it in JavaScript yet, but RFC 9562 makes it short to write:

function uuidv7() {
  const bytes = crypto.getRandomValues(new Uint8Array(16));
  const ms = BigInt(Date.now());
  for (let i = 0; i < 6; i++) bytes[i] = Number((ms >> BigInt(8 * (5 - i))) & 0xffn);
  bytes[6] = (bytes[6] & 0x0f) | 0x70; // version 7
  bytes[8] = (bytes[8] & 0x3f) | 0x80; // RFC variant
  const hex = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
  return [hex.slice(0, 8), hex.slice(8, 12), hex.slice(12, 16), hex.slice(16, 20), hex.slice(20)].join("-");
}

uuidv7(); // "01a14e9b-ce01-7b63-b660-535fa2569f01"

Two IDs created five milliseconds apart compared in creation order as plain strings, and the first 12 hex digits decode back to the creation time. IDs created within the same millisecond are not ordered among themselves, because the rest is random.

import uuid

uuid.uuid4()   # random
uuid.uuid7()   # time-ordered, Python 3.14 and later
str(uuid.uuid4())

uuid.uuid4() uses the operating system's secure random source. uuid.uuid7() arrived in Python 3.14; on older versions, use the JavaScript algorithm above ported to Python, or a maintained package. Call str() before putting a UUID into JSON, because json.dumps cannot serialise a UUID object directly.

select gen_random_uuid();
-- 1463912a-2315-4085-8671-89381ca976c3

create table orders (
  id uuid primary key default gen_random_uuid(),
  created_at timestamptz not null default now()
);

gen_random_uuid() is built into PostgreSQL 13 and later and returns a version 4 UUID. PostgreSQL 18 adds uuidv7() for time-ordered keys. Store UUIDs in a uuid column, not in text: it takes 16 bytes instead of 36 and compares faster.

• Building UUIDs from Math.random(). It is not a secure random source, and some older snippets that use it produce IDs that collide far more often than real UUIDs. Use crypto.randomUUID() or crypto.getRandomValues().
• Treating UUIDs as secrets. A random UUID is hard to guess, but it is not a password or a token: it appears in URLs, logs and analytics. For a password reset link or an API key, generate a dedicated secret and store only its hash.