uuid vs nanoid vs shortid vs randomstring
Generating Unique Identifiers in JavaScript Applications
uuidnanoidshortidrandomstring类似的npm包:

Generating Unique Identifiers in JavaScript Applications

nanoid, uuid, randomstring, and shortid are libraries used to create unique keys for data records, sessions, or temporary tokens. nanoid is a modern, secure, and compact solution designed for current web environments. uuid implements the strict RFC 4122 standard, making it ideal for distributed systems requiring formal identification. randomstring offers flexible configuration for general-purpose random text generation. shortid was once popular for creating short unique IDs but is now deprecated and should not be used in new projects.

npm下载趋势

3 年

GitHub Stars 排名

统计详情

npm包名称
下载量
Stars
大小
Issues
发布时间
License
uuid399,942,44115,34565.7 kB822 天前MIT
nanoid360,043,58727,11814.7 kB21 个月前MIT
shortid1,271,9995,70921.7 kB162 年前MIT
randomstring052217 kB21 个月前MIT

Generating Unique Identifiers in JavaScript Applications

nanoid, uuid, randomstring, and shortid solve the common problem of creating unique keys for data, but they differ significantly in maintenance status, security, and format. Choosing the right one affects your system's reliability and security posture. Let's break down how they compare in real-world engineering scenarios.

⚠️ Maintenance Status: Active vs Deprecated

shortid is no longer maintained.

  • The GitHub repository is archived.
  • npm displays a deprecation warning.
  • Do not use this in new projects.
// shortid: Deprecated
import shortid from 'shortid';
const id = shortid.generate(); // Avoid this

nanoid is actively maintained and widely adopted.

  • Receives regular updates for security and performance.
  • Recommended replacement for shortid.
// nanoid: Active
import { nanoid } from 'nanoid';
const id = nanoid(); // "V1StGXR8_Z5jdHi6B-myT"

uuid is actively maintained and stable.

  • Follows strict RFC standards.
  • Trusted for enterprise-grade systems.
// uuid: Active
import { v4 as uuidv4 } from 'uuid';
const id = uuidv4(); // "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"

randomstring is maintained but less focused on ID uniqueness.

  • Good for general random text.
  • Not optimized for collision resistance.
// randomstring: Active
import RandomString from 'randomstring';
const id = RandomString.generate(); // "x8Wk9pL2"

📏 ID Format and Length

The shape of the ID matters for storage, URLs, and readability.

nanoid produces short, URL-friendly strings.

  • Default length is 21 characters.
  • Uses A-Z, a-z, 0-9, _, -.
  • Safe for URLs and file names.
// nanoid
import { nanoid } from 'nanoid';
const id = nanoid(); // 21 chars
const custom = nanoid(10); // 10 chars

uuid produces standard 36-character strings.

  • Includes hyphens in fixed positions.
  • Not URL-safe without encoding (hyphens are fine, but length is verbose).
  • Recognizable format across languages.
// uuid
import { v4 as uuidv4 } from 'uuid';
const id = uuidv4(); // 36 chars

randomstring produces configurable strings.

  • You define length and character set.
  • Can include symbols that break URLs.
// randomstring
import RandomString from 'randomstring';
const id = RandomString.generate({ length: 15, charset: 'alphanumeric' });

shortid produced short strings similar to nanoid.

  • Now obsolete.
  • Format is no longer guaranteed secure.
// shortid
import shortid from 'shortid';
const id = shortid.generate(); // Variable length

🔒 Security and Collision Risk

Unique IDs must avoid collisions to prevent data overwrites or security gaps.

nanoid uses the crypto module for random generation.

  • High entropy.
  • Low collision risk even at scale.
  • Secure for session IDs and public tokens.
// nanoid: Secure random
import { nanoid } from 'nanoid';
const token = nanoid(); 

uuid v4 uses random numbers.

  • Standardized randomness.
  • Secure for distributed systems.
  • v1 uses timestamps (not secure for hiding creation time).
// uuid: Secure random (v4)
import { v4 as uuidv4 } from 'uuid';
const token = uuidv4();

randomstring depends on configuration.

  • Default may not be cryptographically strong.
  • Riskier for security-sensitive tokens.
// randomstring: Check config
import RandomString from 'randomstring';
const token = RandomString.generate({ length: 32, charset: 'hex' });

shortid had known collision issues over time.

  • Another reason to avoid it.
  • Not safe for high-volume systems.
// shortid: Unsafe
import shortid from 'shortid';
const token = shortid.generate(); 

🌐 Environment Support

All packages work in Node.js and browsers, but bundle impact varies.

nanoid is tiny.

  • Minimal impact on bundle size.
  • No polyfills needed for modern browsers.
// nanoid: Lightweight
import { nanoid } from 'nanoid';

uuid is larger.

  • More code to handle RFC logic.
  • May require polyfills for older environments.
// uuid: Heavier
import { v4 as uuidv4 } from 'uuid';

randomstring is moderate.

  • Depends on character set logic.
// randomstring: Moderate
import RandomString from 'randomstring';

shortid is small but deprecated.

  • Size doesn't matter if it's unsafe.
// shortid: Deprecated
import shortid from 'shortid';

📊 Summary Table

Featurenanoiduuidrandomstringshortid
Status✅ Active✅ Active✅ Active❌ Deprecated
LengthShort (21)Long (36)ConfigurableShort
URL Safe✅ Yes❌ No (hyphens)✅ Configurable✅ Yes
RFC Standard❌ No✅ Yes (RFC 4122)❌ No❌ No
Security✅ High✅ High⚠️ Medium❌ Low
Bundle Impact🟢 Low🟡 Medium🟡 Medium🟢 Low

💡 Final Recommendation

nanoid is the default choice for modern web development. It balances security, size, and usability better than the rest. Use it for database keys, session tokens, and URL slugs.

uuid is for legacy or strict systems. Use it when you must match existing infrastructure that expects RFC 4122 IDs. It is reliable but verbose.

randomstring is for non-critical data. Use it for temporary passwords or test data where format flexibility matters more than collision guarantees.

shortid should be avoided. It is deprecated and unsafe. Migrate existing usage to nanoid immediately.

Final Thought: Unique IDs are foundational to data integrity. Choose tools that are actively maintained and secure by default — nanoid leads this category for frontend and full-stack JavaScript today.

如何选择: uuid vs nanoid vs shortid vs randomstring

  • uuid:

    Choose uuid when your system requires strict RFC 4122 compliance or interoperability with legacy systems that expect standard UUID formats. It is the industry standard for distributed tracing and database keys where format consistency matters more than string length. Use it if you need specific versions like v1 (time-based) or v4 (random).

  • nanoid:

    Choose nanoid for most modern frontend and backend tasks where you need secure, URL-friendly IDs without the verbosity of UUIDs. It is small, fast, and actively maintained, making it the default choice for new applications. Use it when you want simplicity and strong collision resistance without extra configuration.

  • shortid:

    Do not choose shortid for any new project. The package is deprecated, the repository is archived, and it no longer receives security updates. Existing projects should migrate to nanoid or uuid to ensure long-term stability and safety.

  • randomstring:

    Choose randomstring for non-critical tasks like generating temporary passwords, captcha codes, or test data where cryptographic security is not the primary concern. It allows heavy customization of character sets and length, which is useful for specific format requirements. Avoid it for primary database keys where collision risk must be minimized.

uuid的README

uuid CI Browser

For the creation of RFC9562 (formerly RFC4122) UUIDs

[!NOTE]

Starting with uuid@12 CommonJS is no longer supported. See implications and motivation for details.

Quickstart

1. Install

npm install uuid

2. Create a UUID

import { v4 as uuidv4 } from 'uuid';

uuidv4(); // ⇨ 'b18794e8-5d0d-417c-b361-ba38e78411b4'

For timestamp UUIDs, namespace UUIDs, and other options read on ...

API Summary

uuid.NILThe nil UUID string (all zeros)
uuid.MAXThe max UUID string (all ones)
uuid.parse()Convert UUID string to array of bytes
uuid.stringify()Convert array of bytes to UUID string
uuid.v1()Generate a version 1 (timestamp) UUID
uuid.v1ToV6()Convert a version 1 UUID to version 6
uuid.v3()Generate a version 3 (namespace w/ MD5) UUID
uuid.v4()Generate a version 4 (random) UUID
uuid.v5()Generate a version 5 (namespace w/ SHA-1) UUID
uuid.v6()Generate a version 6 (timestamp, reordered) UUID
uuid.v6ToV1()Convert a version 6 UUID to version 1
uuid.v7()Generate a version 7 (Unix Epoch time-based) UUID
uuid.v8()"Intentionally left blank"
uuid.validate()Test a string to see if it is a valid UUID
uuid.version()Detect RFC version of a UUID

API

uuid.NIL

The nil UUID string (all zeros).

Example:

import { NIL as NIL_UUID } from 'uuid';

NIL_UUID; // ⇨ '00000000-0000-0000-0000-000000000000'

uuid.MAX

The max UUID string (all ones).

Example:

import { MAX as MAX_UUID } from 'uuid';

MAX_UUID; // ⇨ 'ffffffff-ffff-ffff-ffff-ffffffffffff'

uuid.parse(str)

Convert UUID string to array of bytes

strA valid UUID String
returnsUint8Array[16]
throwsTypeError if str is not a valid UUID

[!NOTE] Ordering of values in the byte arrays used by parse() and stringify() follows the left ↠ right order of hex-pairs in UUID strings. As shown in the example below.

Example:

import { parse as uuidParse } from 'uuid';

// Parse a UUID
uuidParse('6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'); // ⇨
// Uint8Array(16) [
//   110, 192, 189, 127,  17,
//   192,  67, 218, 151,  94,
//    42, 138, 217, 235, 174,
//    11
// ]

uuid.stringify(arr[, offset])

Convert array of bytes to UUID string

arrArray-like collection of 16 values (starting from offset) between 0-255.
[offset = 0]Number Starting index in the Array
returnsString
throwsTypeError if a valid UUID string cannot be generated

[!NOTE] Ordering of values in the byte arrays used by parse() and stringify() follows the left ↠ right order of hex-pairs in UUID strings. As shown in the example below.

Example:

import { stringify as uuidStringify } from 'uuid';

const uuidBytes = Uint8Array.of(
  0x6e,
  0xc0,
  0xbd,
  0x7f,
  0x11,
  0xc0,
  0x43,
  0xda,
  0x97,
  0x5e,
  0x2a,
  0x8a,
  0xd9,
  0xeb,
  0xae,
  0x0b
);

uuidStringify(uuidBytes); // ⇨ '6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'

uuid.v1([options[, buffer[, offset]]])

Create an RFC version 1 (timestamp) UUID

[options]Object with one or more of the following properties:
[options.node = (random) ]RFC "node" field as an Array[6] of byte values (per 4.1.6)
[options.clockseq = (random)]RFC "clock sequence" as a Number between 0 - 0x3fff
[options.msecs = (current time)]RFC "timestamp" field (Number of milliseconds, unix epoch)
[options.nsecs = 0]RFC "timestamp" field (Number of nanoseconds to add to msecs, should be 0-10,000)
[options.random = (random)]Array of 16 random bytes (0-255) used to generate other fields, above
[options.rng]Alternative to options.random, a Function that returns an Array of 16 random bytes (0-255)
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer
throwsError if more than 10M UUIDs/sec are requested

Example:

import { v1 as uuidv1 } from 'uuid';

uuidv1(); // ⇨ '57fd0000-c7d3-11ef-841d-514d2167fc5b'

Example using options:

import { v1 as uuidv1 } from 'uuid';

const options = {
  node: Uint8Array.of(0x01, 0x23, 0x45, 0x67, 0x89, 0xab),
  clockseq: 0x1234,
  msecs: new Date('2011-11-01').getTime(),
  nsecs: 5678,
};
uuidv1(options); // ⇨ '710b962e-041c-11e1-9234-0123456789ab'

uuid.v1ToV6(uuid)

Convert a UUID from version 1 to version 6

import { v1ToV6 } from 'uuid';

v1ToV6('92f62d9e-22c4-11ef-97e9-325096b39f47'); // ⇨ '1ef22c49-2f62-6d9e-97e9-325096b39f47'

uuid.v3(name, namespace[, buffer[, offset]])

Create an RFC version 3 (namespace w/ MD5) UUID

API is identical to v5(), but uses "v3" instead.

[!IMPORTANT] Per the RFC, "If backward compatibility is not an issue, SHA-1 [Version 5] is preferred."

uuid.v4([options[, buffer[, offset]]])

Create an RFC version 4 (random) UUID

[options]Object with one or more of the following properties:
[options.random]Array of 16 random bytes (0-255)
[options.rng]Alternative to options.random, a Function that returns an Array of 16 random bytes (0-255)
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer

Example:

import { v4 as uuidv4 } from 'uuid';

uuidv4(); // ⇨ 'b18794e8-5d0d-417c-b361-ba38e78411b4'

Example using predefined random values:

import { v4 as uuidv4 } from 'uuid';

const v4options = {
  random: Uint8Array.of(
    0x10,
    0x91,
    0x56,
    0xbe,
    0xc4,
    0xfb,
    0xc1,
    0xea,
    0x71,
    0xb4,
    0xef,
    0xe1,
    0x67,
    0x1c,
    0x58,
    0x36
  ),
};
uuidv4(v4options); // ⇨ '109156be-c4fb-41ea-b1b4-efe1671c5836'

uuid.v5(name, namespace[, buffer[, offset]])

Create an RFC version 5 (namespace w/ SHA-1) UUID

nameString | Array
namespaceString | Array[16] Namespace UUID
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer

[!NOTE] The RFC DNS and URL namespaces are available as v5.DNS and v5.URL.

Example with custom namespace:

import { v5 as uuidv5 } from 'uuid';

// Define a custom namespace.  Readers, create your own using something like
// https://www.uuidgenerator.net/
const MY_NAMESPACE = '1b671a64-40d5-491e-99b0-da01ff1f3341';

uuidv5('Hello, World!', MY_NAMESPACE); // ⇨ '630eb68f-e0fa-5ecc-887a-7c7a62614681'

Example with RFC URL namespace:

import { v5 as uuidv5 } from 'uuid';

uuidv5('https://www.w3.org/', uuidv5.URL); // ⇨ 'c106a26a-21bb-5538-8bf2-57095d1976c1'

uuid.v6([options[, buffer[, offset]]])

Create an RFC version 6 (timestamp, reordered) UUID

This method takes the same arguments as uuid.v1().

import { v6 as uuidv6 } from 'uuid';

uuidv6(); // ⇨ '1efc7d35-7fd0-6000-841d-504d2167fc5b'

Example using options:

import { v6 as uuidv6 } from 'uuid';

const options = {
  node: [0x01, 0x23, 0x45, 0x67, 0x89, 0xab],
  clockseq: 0x1234,
  msecs: new Date('2011-11-01').getTime(),
  nsecs: 5678,
};
uuidv6(options); // ⇨ '1e1041c7-10b9-662e-9234-0123456789ab'

uuid.v6ToV1(uuid)

Convert a UUID from version 6 to version 1

import { v6ToV1 } from 'uuid';

v6ToV1('1ef22c49-2f62-6d9e-97e9-325096b39f47'); // ⇨ '92f62d9e-22c4-11ef-97e9-325096b39f47'

uuid.v7([options[, buffer[, offset]]])

Create an RFC version 7 (random) UUID

[options]Object with one or more of the following properties:
[options.msecs = (current time)]RFC "timestamp" field (Number of milliseconds, unix epoch)
[options.random = (random)]Array of 16 random bytes (0-255) used to generate other fields, above
[options.rng]Alternative to options.random, a Function that returns an Array of 16 random bytes (0-255)
[options.seq = (random)]32-bit sequence Number between 0 - 0xffffffff. This may be provided to help ensure uniqueness for UUIDs generated within the same millisecond time interval. Default = random value.
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer

Example:

import { v7 as uuidv7 } from 'uuid';

uuidv7(); // ⇨ '01941f29-7c00-73e4-a310-744d2167fc5b'

uuid.v8()

"Intentionally left blank"

[!NOTE] Version 8 (experimental) UUIDs are "for experimental or vendor-specific use cases". The RFC does not define a creation algorithm for them, which is why this package does not offer a v8() method. The validate() and version() methods do work with such UUIDs, however.

uuid.validate(str)

Test a string to see if it is a valid UUID

strString to validate
returnstrue if string is a valid UUID, false otherwise

Example:

import { validate as uuidValidate } from 'uuid';

uuidValidate('not a UUID'); // ⇨ false
uuidValidate('6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'); // ⇨ true

Using validate and version together it is possible to do per-version validation, e.g. validate for only v4 UUIds.

import { version as uuidVersion } from 'uuid';
import { validate as uuidValidate } from 'uuid';

function uuidValidateV4(uuid) {
  return uuidValidate(uuid) && uuidVersion(uuid) === 4;
}

const v1Uuid = 'd9428888-122b-11e1-b85c-61cd3cbb3210';
const v4Uuid = '109156be-c4fb-41ea-b1b4-efe1671c5836';

uuidValidateV4(v4Uuid); // ⇨ true
uuidValidateV4(v1Uuid); // ⇨ false

uuid.version(str)

Detect RFC version of a UUID

strA valid UUID String
returnsNumber The RFC version of the UUID
throwsTypeError if str is not a valid UUID

Example:

import { version as uuidVersion } from 'uuid';

uuidVersion('45637ec4-c85f-11ea-87d0-0242ac130003'); // ⇨ 1
uuidVersion('6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'); // ⇨ 4

[!NOTE] This method returns 0 for the NIL UUID, and 15 for the MAX UUID.

Command Line

UUIDs can be generated from the command line using uuid.

$ npx uuid
ddeb27fb-d9a0-4624-be4d-4615062daed4

The default is to generate version 4 UUIDS, however the other versions are supported. Type uuid --help for details:

$ npx uuid --help

Usage:
  uuid
  uuid v1
  uuid v3 <name> <namespace uuid>
  uuid v4
  uuid v5 <name> <namespace uuid>
  uuid v7
  uuid --help

Note: <namespace uuid> may be "URL" or "DNS" to use the corresponding UUIDs
defined by RFC9562

options Handling for Timestamp UUIDs

Prior to uuid@11, it was possible for options state to interfere with the internal state used to ensure uniqueness of timestamp-based UUIDs (the v1(), v6(), and v7() methods). Starting with uuid@11, this issue has been addressed by using the presence of the options argument as a flag to select between two possible behaviors:

  • Without options: Internal state is utilized to improve UUID uniqueness.
  • With options: Internal state is NOT used and, instead, appropriate defaults are applied as needed.

Support

Browsers: uuid builds are tested against the latest version of desktop Chrome, Safari, Firefox, and Edge. Mobile versions of these same browsers are expected to work but aren't currently tested.

Node: uuid builds are tested against node (LTS releases), plus one prior. E.g. At the time of this writing node@20 is the "maintenance" release and node@24 is the "current" release, so uuid supports node@20-node@24.

Typescript: TS versions released within the past two years are supported. source

Known issues

"getRandomValues() not supported"

This error occurs in environments where the standard crypto.getRandomValues() API is not supported. This issue can be resolved by adding an appropriate polyfill:

React Native / Expo

  1. Install react-native-get-random-values
  2. Import it before uuid. Since uuid might also appear as a transitive dependency of some other imports it's safest to just import react-native-get-random-values as the very first thing in your entry point:
import 'react-native-get-random-values';
import { v4 as uuidv4 } from 'uuid';

Generated from README_js.md by runmd