Hello!

In this article, we look at UUID generation in Node.js, a mainstay of modern web front ends—specifically, howcrypto.randomUUID()differs from the traditional approach.

Introduction

UUIDs are widely used as unique identifiers, and Node.js offers more than one way to generate them.

How to Use crypto.randomUUID()

import { randomUUID } from 'crypto';

const id = randomUUID();
console.log(id); // e.g. '123e4567-e89b-12d3-a456-426614174000'

Alternatively, you can write it like this:

import crypto from 'crypto';
const id= crypto.randomUUID();

Key Characteristics

• Uses a cryptographically secure random number generator
• No additional package installation required
• Performance is already optimized
• Generates UUID v4 format

The Traditional Way to Generate UUIDs

import { v4 as uuidv4 } from 'uuid';

const id = uuidv4();
console.log(id);

Characteristics

• Supports multiple UUID versions
• Rich customization options
• Long track record in the community
• Requires installing an NPM package

Using Multiple UUID Versions

import { v1, v3, v4, v5 } from 'uuid';

const timeBasedId = v1();  // time-based
const nameBasedMD5Id = v3('hello', v3.DNS);  // name-based (MD5)
const randomId = v4();  // random
const nameBasedSHA1Id = v5('hello', v5.DNS);  // name-based (SHA-1)

Which Should You Choose?

When to Choose crypto.randomUUID()

• When security matters
• When you want to keep dependencies to a minimum
• When simple UUID v4 generation is all you need

When to Choose the uuid Package

• When you need a specific UUID version
• When you want to customize the generation process
• When you need compatibility with older versions of Node.js

Conclusion

Choose the approach that fits your project's requirements. Unless you have a specific reason not to, we recommend using the built-incrypto.randomUUID().

Appendix: What Makes a Random Number Cryptographically Secure?

So what exactly is a cryptographically secure random number generator (CSPRNG)?

Saying it's simply "good for security" may leave you wanting more, so let's take a closer look in this appendix.

Basic Characteristics

A cryptographically secure random number generator fundamentally has the following characteristics:

1. Unpredictability

• It is practically impossible to predict the next value it will generate
• No pattern can be found in its past output

2. Uniform Distribution

• Every possible value appears with equal probability
• No bias

How It Differs from an Ordinary Random Number Generator

For example, let's compare it with JavaScript'sMath.random():

// Ordinary random number generation
const normal = Math.random();

// Cryptographically secure random number generation
import { randomBytes } from 'crypto';
const secure = randomBytes(8).readBigUInt64BE() / BigInt(2 ** 64);

Problems with Math.random()

• The next value can be predicted from the seed
• Unsuitable for cryptographic purposes
• The pseudorandom number algorithm is relatively simple

Advantages of crypto.randomUUID()

• Uses the cryptographic randomness source provided by the OS (such as /dev/urandom on Linux)
• Draws on physical noise sources
• Extremely difficult to predict

Real-World Use Cases

Situations where cryptographically secure randomness matters:

1. Generating security tokens

import { randomBytes } from 'crypto';
const secureToken = randomBytes(32).toString('hex');

1. Password reset tokens

import { randomUUID } from 'crypto';
const resetToken = randomUUID();

1. Generating initialization vectors (IVs)

import { randomBytes } from 'crypto';
const iv = randomBytes(16); // for AES-256

Visualizing the Actual Difference

Let's look at the difference between an ordinary random number generator and a cryptographically secure one:

import { randomBytes } from 'crypto';

// Ordinary random sequence
const normalRandoms = Array.from(
  { length: 1000 }, 
  () => Math.random()
);

// Cryptographically secure random sequence
const secureRandoms = Array.from(
  { length: 1000 }, 
  () => randomBytes(8).readBigUInt64BE() / BigInt(2 ** 64)
);

An ordinary random number generator is well suited to producing large volumes of values quickly, but because its output is predictable, it is not appropriate for security-critical uses.

A cryptographically secure random number generator, on the other hand:

• Has more entropy (randomness)
• Is practically impossible to predict
• Costs more to compute, but guarantees security

This is whycrypto.randomUUID()is recommended for UUID generation. This unpredictability is especially critical in security-sensitive contexts such as authentication tokens and session IDs.