uuid vs node-uuid vs uuidv4 vs uuid-random
Generating Unique Identifiers in JavaScript Applications
uuidnode-uuiduuidv4uuid-randomSimilar Packages:

Generating Unique Identifiers in JavaScript Applications

This comparison evaluates four npm packages used for generating Universally Unique Identifiers (UUIDs) in JavaScript projects. While uuid is the current industry standard, legacy packages like node-uuid and specialized wrappers like uuidv4 or uuid-random still appear in existing codebases. Understanding their maintenance status, API differences, and security implications is critical for maintaining secure and future-proof applications.

Npm Package Weekly Downloads Trend

3 Years

Github Stars Ranking

Stat Detail

Package
Downloads
Stars
Size
Issues
Publish
License
uuid266,356,54315,30865.7 kB2a month agoMIT
node-uuid1,021,148269-09 years ago-
uuidv4629,975-17.4 kB--MIT
uuid-random357,606104-16 years agoMIT

UUID Generation Packages: Stability, Security, and API Compared

Generating unique identifiers is a common task in web development, used for session IDs, database keys, and tracking events. While the goal is simple β€” create a unique string β€” the packages available vary wildly in maintenance status and security. Let's compare node-uuid, uuid, uuid-random, and uuidv4 to see which one belongs in your project.

πŸ›‘ Maintenance Status: Active vs. Deprecated

The most critical factor is whether the package is still maintained. Using deprecated libraries exposes your application to unpatched security vulnerabilities.

uuid is the active standard.

  • Maintained by the community (kelektiv).
  • Receives regular updates for security and Node.js compatibility.
  • The official successor to node-uuid.
// uuid: Actively maintained
import { v4 } from 'uuid';
const id = v4();

node-uuid is officially deprecated.

  • npm marks it as deprecated since 2015.
  • Redirects users to uuid.
  • Should never be installed in new projects.
// node-uuid: Deprecated
const uuid = require('node-uuid');
const id = uuid.v4(); // Works, but unsupported

uuidv4 is a specialized wrapper.

  • Often unmaintained or updated infrequently.
  • Redundant because uuid now supports tree-shaking.
  • Risk of falling behind on security patches.
// uuidv4: Specialized wrapper
import uuidv4 from 'uuidv4';
const id = uuidv4(); // Single function export

uuid-random is a niche alternative.

  • Less community scrutiny than uuid.
  • Maintenance status varies by specific fork.
  • Generally unnecessary given the robustness of uuid.
// uuid-random: Niche alternative
import uuid from 'uuid-random';
const id = uuid(); // Direct function call

πŸ› οΈ API Simplicity: How You Import and Use

Developer experience matters. You want an API that is clear, consistent, and easy to test. The packages differ in how they export their functions.

uuid uses named exports for specific versions.

  • Clear distinction between v1, v4, v5, etc.
  • Supports both CommonJS and ES Modules.
  • Encourages importing only what you need.
// uuid: Named exports
import { v4 as uuidv4 } from 'uuid';
const id = uuidv4();

node-uuid uses a default object export.

  • Older style common in early Node.js.
  • All versions hang off the main object.
  • Harder for bundlers to tree-shake effectively.
// node-uuid: Object export
const uuid = require('node-uuid');
const id = uuid.v4();

uuidv4 uses a default function export.

  • Simplest import for v4 specifically.
  • No need to destructure.
  • Limits you to only version 4.
// uuidv4: Default function
import uuidv4 from 'uuidv4';
const id = uuidv4();

uuid-random uses a default function export.

  • Similar to uuidv4.
  • Focuses purely on random generation.
  • Less flexible if you need other versions later.
// uuid-random: Default function
import uuid from 'uuid-random';
const id = uuid();

🌍 Environment Support: Node.js vs. Browser

Your code might run on a server, in a browser, or in a serverless function. The package must handle cryptographic random number generation correctly in all environments.

uuid handles environments automatically.

  • Detects if it is in Node.js or a browser.
  • Uses crypto.randomBytes in Node.
  • Uses msCrypto or crypto.getRandomValues in browsers.
// uuid: Universal support
// Works seamlessly in Webpack, Vite, or Node
import { v4 } from 'uuid';

node-uuid was built primarily for Node.

  • Older versions struggled in browsers without polyfills.
  • Relied on global objects that might not exist.
  • Not optimized for modern bundlers.
// node-uuid: Node-focused
// May require shims for browser usage
const uuid = require('node-uuid');

uuidv4 depends on underlying implementation.

  • Some versions rely on Math.random (insecure).
  • Others wrap the main uuid package.
  • You must check the source to ensure security.
// uuidv4: Check source
// Verify it uses crypto, not Math.random
import uuidv4 from 'uuidv4';

uuid-random varies by version.

  • Some implementations prioritize speed over security.
  • May not be suitable for security-sensitive IDs.
  • Less documentation on environment limits.
// uuid-random: Varies
// Review docs for browser compatibility
import uuid from 'uuid-random';

πŸ”’ Security & Entropy: Randomness Quality

For UUIDs to be unique and safe, they need high-quality randomness. Weak random number generators can lead to collisions or predictable IDs.

uuid uses cryptographically strong generators.

  • Adheres to RFC 4122 standards.
  • Uses system-level crypto APIs.
  • Safe for session tokens and security keys.
// uuid: Cryptographically strong
import { v4 } from 'uuid';
// Safe for security-sensitive contexts

node-uuid had older security models.

  • Earlier versions used weaker random sources.
  • Deprecated status means no new security fixes.
  • Risk of known vulnerabilities.
// node-uuid: Older security model
// Not recommended for security tokens
const uuid = require('node-uuid');

uuidv4 depends on the specific package.

  • Some lightweight versions use Math.random.
  • Math.random is NOT cryptographically secure.
  • Can lead to predictable IDs.
// uuidv4: Verify security
// Avoid if it uses Math.random internally
import uuidv4 from 'uuidv4';

uuid-random focuses on speed.

  • May sacrifice entropy for performance.
  • Not ideal for authentication or sensitive data.
  • Use only for non-critical tracking IDs.
// uuid-random: Speed focused
// Avoid for auth tokens
import uuid from 'uuid-random';

πŸ“Š Summary: Key Differences

Featureuuidnode-uuiduuidv4uuid-random
Statusβœ… Active❌ Deprecated⚠️ Mixed⚠️ Mixed
API StyleNamed ExportsObject ExportDefault FunctionDefault Function
SecurityπŸ”’ High⚠️ Low❓ Verify❓ Verify
Environments🌐 UniversalπŸ–₯️ Node-focused🌐 Varies🌐 Varies
Versionsv1, v3, v4, v5v1, v4v4 Onlyv4 Only

πŸ’‘ The Big Picture

uuid is the clear winner for modern development. It is the standard for a reason β€” it is secure, maintained, and works everywhere. The small convenience of shorter import names in uuidv4 or uuid-random is not worth the risk of using less maintained code.

node-uuid should be treated as technical debt. If you see it in your codebase, plan a migration to uuid. It is a simple find-and-replace task that improves your security posture.

uuidv4 and uuid-random solve problems that no longer exist. Modern bundlers can tree-shake the main uuid package effectively, so you do not need a separate package to save space. Stick to the main library to ensure you get security updates and consistent behavior across your team.

Final Thought: In infrastructure code, boring is good. Choose the package with the most eyes on it, the longest track record, and the active maintenance. That is uuid.

How to Choose: uuid vs node-uuid vs uuidv4 vs uuid-random

  • uuid:

    Choose uuid for almost all use cases. It is the actively maintained standard, supports multiple UUID versions (v1, v3, v4, v5), and works reliably in both Node.js and browser environments. It offers the best balance of security, performance, and long-term support.

  • node-uuid:

    Do not use this package in new projects. It is officially deprecated and has been renamed to uuid. Continuing to use it introduces security risks and technical debt because it no longer receives updates or bug fixes. Migrate existing code to the uuid package immediately.

  • uuidv4:

    Only use this if you are locked into a legacy codebase that cannot tolerate refactoring. Modern versions of uuid allow tree-shaking, so importing only the v4 function no longer carries a bundle size penalty. There is no technical advantage to using this standalone wrapper today.

  • uuid-random:

    Avoid this package unless you have a very specific legacy constraint. It is less maintained than uuid and offers no significant security or performance benefits. The main uuid package provides equivalent random generation capabilities with better community trust.

README for uuid

uuid CI Browser

For the creation of RFC9562 (formerly RFC4122) UUIDs

[!NOTE]

Starting with uuid@12 CommonJS is no longer supported. See implications and motivation for details.

Quickstart

1. Install

npm install uuid

2. Create a UUID

import { v4 as uuidv4 } from 'uuid';

uuidv4(); // ⇨ 'b18794e8-5d0d-417c-b361-ba38e78411b4'

For timestamp UUIDs, namespace UUIDs, and other options read on ...

API Summary

uuid.NILThe nil UUID string (all zeros)New in uuid@8.3
uuid.MAXThe max UUID string (all ones)New in uuid@9.1
uuid.parse()Convert UUID string to array of bytesNew in uuid@8.3
uuid.stringify()Convert array of bytes to UUID stringNew in uuid@8.3
uuid.v1()Create a version 1 (timestamp) UUID
uuid.v1ToV6()Create a version 6 UUID from a version 1 UUIDNew in uuid@10
uuid.v3()Create a version 3 (namespace w/ MD5) UUID
uuid.v4()Create a version 4 (random) UUID
uuid.v5()Create a version 5 (namespace w/ SHA-1) UUID
uuid.v6()Create a version 6 (timestamp, reordered) UUIDNew in uuid@10
uuid.v6ToV1()Create a version 1 UUID from a version 6 UUIDNew in uuid@10
uuid.v7()Create a version 7 (Unix Epoch time-based) UUIDNew in uuid@10
uuid.v8()"Intentionally left blank"
uuid.validate()Test a string to see if it is a valid UUIDNew in uuid@8.3
uuid.version()Detect RFC version of a UUIDNew in uuid@8.3

API

uuid.NIL

The nil UUID string (all zeros).

Example:

import { NIL as NIL_UUID } from 'uuid';

NIL_UUID; // ⇨ '00000000-0000-0000-0000-000000000000'

uuid.MAX

The max UUID string (all ones).

Example:

import { MAX as MAX_UUID } from 'uuid';

MAX_UUID; // ⇨ 'ffffffff-ffff-ffff-ffff-ffffffffffff'

uuid.parse(str)

Convert UUID string to array of bytes

strA valid UUID String
returnsUint8Array[16]
throwsTypeError if str is not a valid UUID

[!NOTE] Ordering of values in the byte arrays used by parse() and stringify() follows the left β†  right order of hex-pairs in UUID strings. As shown in the example below.

Example:

import { parse as uuidParse } from 'uuid';

// Parse a UUID
uuidParse('6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'); // ⇨
// Uint8Array(16) [
//   110, 192, 189, 127,  17,
//   192,  67, 218, 151,  94,
//    42, 138, 217, 235, 174,
//    11
// ]

uuid.stringify(arr[, offset])

Convert array of bytes to UUID string

arrArray-like collection of 16 values (starting from offset) between 0-255.
[offset = 0]Number Starting index in the Array
returnsString
throwsTypeError if a valid UUID string cannot be generated

[!NOTE] Ordering of values in the byte arrays used by parse() and stringify() follows the left β†  right order of hex-pairs in UUID strings. As shown in the example below.

Example:

import { stringify as uuidStringify } from 'uuid';

const uuidBytes = Uint8Array.of(
  0x6e,
  0xc0,
  0xbd,
  0x7f,
  0x11,
  0xc0,
  0x43,
  0xda,
  0x97,
  0x5e,
  0x2a,
  0x8a,
  0xd9,
  0xeb,
  0xae,
  0x0b
);

uuidStringify(uuidBytes); // ⇨ '6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'

uuid.v1([options[, buffer[, offset]]])

Create an RFC version 1 (timestamp) UUID

[options]Object with one or more of the following properties:
[options.node = (random) ]RFC "node" field as an Array[6] of byte values (per 4.1.6)
[options.clockseq = (random)]RFC "clock sequence" as a Number between 0 - 0x3fff
[options.msecs = (current time)]RFC "timestamp" field (Number of milliseconds, unix epoch)
[options.nsecs = 0]RFC "timestamp" field (Number of nanoseconds to add to msecs, should be 0-10,000)
[options.random = (random)]Array of 16 random bytes (0-255) used to generate other fields, above
[options.rng]Alternative to options.random, a Function that returns an Array of 16 random bytes (0-255)
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer
throwsError if more than 10M UUIDs/sec are requested

Example:

import { v1 as uuidv1 } from 'uuid';

uuidv1(); // ⇨ '57fd0000-c7d3-11ef-841d-514d2167fc5b'

Example using options:

import { v1 as uuidv1 } from 'uuid';

const options = {
  node: Uint8Array.of(0x01, 0x23, 0x45, 0x67, 0x89, 0xab),
  clockseq: 0x1234,
  msecs: new Date('2011-11-01').getTime(),
  nsecs: 5678,
};
uuidv1(options); // ⇨ '710b962e-041c-11e1-9234-0123456789ab'

uuid.v1ToV6(uuid)

Convert a UUID from version 1 to version 6

import { v1ToV6 } from 'uuid';

v1ToV6('92f62d9e-22c4-11ef-97e9-325096b39f47'); // ⇨ '1ef22c49-2f62-6d9e-97e9-325096b39f47'

uuid.v3(name, namespace[, buffer[, offset]])

Create an RFC version 3 (namespace w/ MD5) UUID

API is identical to v5(), but uses "v3" instead.

[!IMPORTANT] Per the RFC, "If backward compatibility is not an issue, SHA-1 [Version 5] is preferred."

uuid.v4([options[, buffer[, offset]]])

Create an RFC version 4 (random) UUID

[options]Object with one or more of the following properties:
[options.random]Array of 16 random bytes (0-255)
[options.rng]Alternative to options.random, a Function that returns an Array of 16 random bytes (0-255)
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer

Example:

import { v4 as uuidv4 } from 'uuid';

uuidv4(); // ⇨ 'b18794e8-5d0d-417c-b361-ba38e78411b4'

Example using predefined random values:

import { v4 as uuidv4 } from 'uuid';

const v4options = {
  random: Uint8Array.of(
    0x10,
    0x91,
    0x56,
    0xbe,
    0xc4,
    0xfb,
    0xc1,
    0xea,
    0x71,
    0xb4,
    0xef,
    0xe1,
    0x67,
    0x1c,
    0x58,
    0x36
  ),
};
uuidv4(v4options); // ⇨ '109156be-c4fb-41ea-b1b4-efe1671c5836'

uuid.v5(name, namespace[, buffer[, offset]])

Create an RFC version 5 (namespace w/ SHA-1) UUID

nameString | Array
namespaceString | Array[16] Namespace UUID
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer

[!NOTE] The RFC DNS and URL namespaces are available as v5.DNS and v5.URL.

Example with custom namespace:

import { v5 as uuidv5 } from 'uuid';

// Define a custom namespace.  Readers, create your own using something like
// https://www.uuidgenerator.net/
const MY_NAMESPACE = '1b671a64-40d5-491e-99b0-da01ff1f3341';

uuidv5('Hello, World!', MY_NAMESPACE); // ⇨ '630eb68f-e0fa-5ecc-887a-7c7a62614681'

Example with RFC URL namespace:

import { v5 as uuidv5 } from 'uuid';

uuidv5('https://www.w3.org/', uuidv5.URL); // ⇨ 'c106a26a-21bb-5538-8bf2-57095d1976c1'

uuid.v6([options[, buffer[, offset]]])

Create an RFC version 6 (timestamp, reordered) UUID

This method takes the same arguments as uuid.v1().

import { v6 as uuidv6 } from 'uuid';

uuidv6(); // ⇨ '1efc7d35-7fd0-6000-841d-504d2167fc5b'

Example using options:

import { v6 as uuidv6 } from 'uuid';

const options = {
  node: [0x01, 0x23, 0x45, 0x67, 0x89, 0xab],
  clockseq: 0x1234,
  msecs: new Date('2011-11-01').getTime(),
  nsecs: 5678,
};
uuidv6(options); // ⇨ '1e1041c7-10b9-662e-9234-0123456789ab'

uuid.v6ToV1(uuid)

Convert a UUID from version 6 to version 1

import { v6ToV1 } from 'uuid';

v6ToV1('1ef22c49-2f62-6d9e-97e9-325096b39f47'); // ⇨ '92f62d9e-22c4-11ef-97e9-325096b39f47'

uuid.v7([options[, buffer[, offset]]])

Create an RFC version 7 (random) UUID

[options]Object with one or more of the following properties:
[options.msecs = (current time)]RFC "timestamp" field (Number of milliseconds, unix epoch)
[options.random = (random)]Array of 16 random bytes (0-255) used to generate other fields, above
[options.rng]Alternative to options.random, a Function that returns an Array of 16 random bytes (0-255)
[options.seq = (random)]32-bit sequence Number between 0 - 0xffffffff. This may be provided to help ensure uniqueness for UUIDs generated within the same millisecond time interval. Default = random value.
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer

Example:

import { v7 as uuidv7 } from 'uuid';

uuidv7(); // ⇨ '01941f29-7c00-75f4-a310-744d2167fc5b'

uuid.v8()

"Intentionally left blank"

[!NOTE] Version 8 (experimental) UUIDs are "for experimental or vendor-specific use cases". The RFC does not define a creation algorithm for them, which is why this package does not offer a v8() method. The validate() and version() methods do work with such UUIDs, however.

uuid.validate(str)

Test a string to see if it is a valid UUID

strString to validate
returnstrue if string is a valid UUID, false otherwise

Example:

import { validate as uuidValidate } from 'uuid';

uuidValidate('not a UUID'); // ⇨ false
uuidValidate('6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'); // ⇨ true

Using validate and version together it is possible to do per-version validation, e.g. validate for only v4 UUIds.

import { version as uuidVersion } from 'uuid';
import { validate as uuidValidate } from 'uuid';

function uuidValidateV4(uuid) {
  return uuidValidate(uuid) && uuidVersion(uuid) === 4;
}

const v1Uuid = 'd9428888-122b-11e1-b85c-61cd3cbb3210';
const v4Uuid = '109156be-c4fb-41ea-b1b4-efe1671c5836';

uuidValidateV4(v4Uuid); // ⇨ true
uuidValidateV4(v1Uuid); // ⇨ false

uuid.version(str)

Detect RFC version of a UUID

strA valid UUID String
returnsNumber The RFC version of the UUID
throwsTypeError if str is not a valid UUID

Example:

import { version as uuidVersion } from 'uuid';

uuidVersion('45637ec4-c85f-11ea-87d0-0242ac130003'); // ⇨ 1
uuidVersion('6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'); // ⇨ 4

[!NOTE] This method returns 0 for the NIL UUID, and 15 for the MAX UUID.

Command Line

UUIDs can be generated from the command line using uuid.

$ npx uuid
ddeb27fb-d9a0-4624-be4d-4615062daed4

The default is to generate version 4 UUIDS, however the other versions are supported. Type uuid --help for details:

$ npx uuid --help

Usage:
  uuid
  uuid v1
  uuid v3 <name> <namespace uuid>
  uuid v4
  uuid v5 <name> <namespace uuid>
  uuid v7
  uuid --help

Note: <namespace uuid> may be "URL" or "DNS" to use the corresponding UUIDs
defined by RFC9562

options Handling for Timestamp UUIDs

Prior to uuid@11, it was possible for options state to interfere with the internal state used to ensure uniqueness of timestamp-based UUIDs (the v1(), v6(), and v7() methods). Starting with uuid@11, this issue has been addressed by using the presence of the options argument as a flag to select between two possible behaviors:

  • Without options: Internal state is utilized to improve UUID uniqueness.
  • With options: Internal state is NOT used and, instead, appropriate defaults are applied as needed.

Support

Browsers: uuid builds are tested against the latest version of desktop Chrome, Safari, Firefox, and Edge. Mobile versions of these same browsers are expected to work but aren't currently tested.

Node: uuid builds are tested against node (LTS releases), plus one prior. E.g. At the time of this writing node@20 is the "maintenance" release and node@24 is the "current" release, so uuid supports node@20-node@24.

Typescript: TS versions released within the past two years are supported. source

Known issues

"getRandomValues() not supported"

This error occurs in environments where the standard crypto.getRandomValues() API is not supported. This issue can be resolved by adding an appropriate polyfill:

React Native / Expo

  1. Install react-native-get-random-values
  2. Import it before uuid. Since uuid might also appear as a transitive dependency of some other imports it's safest to just import react-native-get-random-values as the very first thing in your entry point:
import 'react-native-get-random-values';
import { v4 as uuidv4 } from 'uuid';

Generated from README_js.md by runmd