uuid vs node-uuid vs short-uuid vs uuidv4
前端架构中的 UUID 生成方案选型与风险对比
uuidnode-uuidshort-uuiduuidv4類似套件:

前端架构中的 UUID 生成方案选型与风险对比

uuid 是当前行业标准且积极维护的 RFC 4122 实现库;short-uuid 专注于生成更短的标识符以适应 URL 或数据库索引优化;node-uuid 是 uuid 的旧名,已官方弃用;uuidv4 通常是功能冗余的遗留包装器。本文旨在帮助开发者识别维护风险,根据场景选择正确的 ID 生成策略,避免引入弃用依赖或不必要的包体积开销。

npm下載趨勢

3 年

GitHub Stars 排名

統計詳情

套件
下載數
Stars
大小
Issues
發布時間
許可
uuid399,942,44115,34565.7 kB822 天前MIT
node-uuid1,273,174270-010 年前-
short-uuid960,64852370.9 kB31 年前MIT
uuidv4722,149-17.4 kB--MIT

UUID 生成方案深度对比:标准、缩短与弃用风险

在前端架构设计中,生成唯一标识符(UUID)是常见需求,无论是用于临时会话 ID、客户端请求追踪,还是离线数据同步。然而,npm 生态中存在多个名称相似的包,其中一些已弃用或存在设计缺陷。本文将深入对比 uuid、short-uuid、node-uuid 和 uuidv4,帮助你避开技术债务陷阱。

🚨 维护状态与安全风险

选择第三方库的首要原则是维护状态。在这个对比中,这一点至关重要。

uuid 是目前唯一推荐的标准库。

  • 由 uuidjs 团队维护,完全遵循 RFC 4122 标准。
  • 定期更新以修复安全漏洞(如随机数生成器问题)。
  • 支持 ESM 和 CommonJS,完美适配现代构建工具。
// uuid: 当前标准用法
import { v4 as uuidv4 } from 'uuid';
const id = uuidv4();
// 输出:"550e8400-e29b-41d4-a716-446655440000"

node-uuid 已官方弃用。

  • 这是 uuid 包在 2015 年之前的旧名称。
  • 仓库已归档,不再接收安全补丁。
  • 安装时会看到 npm 警告,提示迁移至 uuid。
// node-uuid: 弃用代码,切勿使用
import uuid from 'node-uuid';
const id = uuid.v4(); 
// 风险:无安全更新,可能包含已知漏洞

uuidv4 属于冗余依赖。

  • 大多数名为 uuidv4 的包只是对 uuid 的简单包装。
  • 维护频率低,部分版本已停止维护。
  • 引入它会增加依赖树深度,且无额外功能增益。
// uuidv4: 冗余代码,不推荐
import uuidv4 from 'uuidv4';
const id = uuidv4();
// 问题:功能与 uuid 包重复,增加构建负担

short-uuid 处于活跃维护状态。

  • 专注于特定场景(短 ID),有明确的维护目标。
  • 依赖 uuid 作为底层生成器,安全性有保障。
  • 适合特定需求,但不适合作为通用 UUID 库替代。
// short-uuid: 特定场景活跃库
import shortUuid from 'short-uuid';
const id = shortUuid.generate();
// 输出:"Kx9s2LmP4nQ7" (长度显著缩短)

🛠️ API 设计与开发者体验

API 的直观性直接影响代码的可读性和重构成本。

uuid 提供模块化导出。

  • 你可以按需引入 v1, v4, v5 等方法,利于 Tree Shaking。
  • 提供 parse 和 stringify 工具函数,方便处理二进制数据。
// uuid: 模块化引入,利于优化
import { v4, v5 } from 'uuid';
const id1 = v4();
const id2 = v5('my-namespace', v5.URL);

short-uuid 提供翻译功能。

  • 不仅生成短 ID,还支持将标准 UUID 转换为短格式,反之亦然。
  • 适合需要双向转换的场景(如数据库存标准格式,URL 用短格式)。
// short-uuid: 支持双向转换
import shortUuid from 'short-uuid';
const short = shortUuid.translate('550e8400-e29b-41d4-a716-446655440000');
const original = shortUuid.fromShort(short);

node-uuid 与 uuidv4 API 过时。

  • 通常导出默认对象或单一函数,缺乏灵活性。
  • 不支持现代 TypeScript 类型推断,需额外安装类型包。
// node-uuid / uuidv4: 老旧 API 风格
import uuid from 'node-uuid';
// 类型定义往往需要 @types/node-uuid,增加配置成本

📏 输出格式与存储效率

ID 的长度直接影响数据库索引大小和 URL 的可分享性。

包名默认格式字符长度适用场景
uuid标准 Hex + 连字符36 字符内部主键、分布式追踪
short-uuidBase57 编码~22 字符公开链接、邀请码
node-uuid标准 Hex + 连字符36 字符❌ 已弃用
uuidv4标准 Hex + 连字符36 字符❌ 冗余

uuid 生成标准格式。

  • 包含连字符,便于人类阅读和调试。
  • 在某些对长度敏感的 NoSQL 键值存储中可能略显浪费。
// uuid: 标准长度
const id = uuidv4(); 
// "f47ac10b-58cc-4372-a567-0e02b2c3d479"

short-uuid 显著压缩长度。

  • 移除连字符并使用更大字符集编码。
  • 减少约 40% 的存储空间,适合高频写入场景。
// short-uuid: 压缩长度
const id = shortUuid.generate();
// "Hn8s2KpL9mQ4xZ7v"

🌐 前端环境兼容性

前端生成 UUID 依赖于加密安全的随机数生成器(CSPRNG)。

uuid 自动适配环境。

  • 在 Node.js 中使用 crypto.randomBytes。
  • 在浏览器中使用 msCrypto 或 crypto.getRandomValues。
  • v9+ 版本对 ESM 支持更好,减少打包配置问题。
// uuid: 自动检测环境
// 浏览器中自动使用 window.crypto
import { v4 } from 'uuid';

short-uuid 继承兼容性。

  • 底层依赖 uuid 或类似逻辑,因此环境兼容性良好。
  • 需注意其自定义字母表在某些传输协议中是否需要 URL 安全编码。
// short-uuid: 可配置字母表
const translator = shortUuid.constants.createTranslator();
// 确保生成的字符在 URL 中无需转义

node-uuid 与 uuidv4 存在隐患。

  • 旧版本可能依赖 window.crypto 的旧 API 或 Node 的旧 crypto 模块。
  • 在严格模式的现代构建工具(如 Vite)中可能报错。
// node-uuid: 潜在构建错误
// 某些旧版本未正确处理 ESM 导出,导致 "default is not a function"

📊 总结与选型建议

特性uuidshort-uuidnode-uuiduuidv4
维护状态✅ 活跃✅ 活跃❌ 弃用⚠️ 遗留
标准合规✅ RFC 4122⚠️ 编码变体✅ (旧版)✅ (旧版)
包体积中等中等 + 依赖小 (但废弃)小 (但冗余)
推荐度⭐⭐⭐⭐⭐⭐⭐⭐❌❌

💡 架构师建议

uuid 是绝大多数情况下的唯一选择。 它提供了稳定性、标准兼容性和长期维护保障。对于前端应用,确保使用最新版本以获得最佳的 Tree Shaking 支持和 ESM 兼容性。

仅在特定场景考虑 short-uuid。 如果你的业务需求涉及生成用户可见的短链接、邀请码,或者数据库索引成本极高,short-uuid 是有价值的补充工具。但不要用它替代内部系统的标准 UUID。

立即清理 node-uuid 和 uuidv4。 检查你的 package.json,如果发现这两个包,请制定迁移计划。它们不仅不再提供价值,还可能成为安全审计中的警告项。使用 uuid 的 v4 方法即可完全替代它们的功能。

最终结论:在现代前端架构中,依赖管理即是风险管理。坚持使用 uuid 作为标准实现,仅在确有必要时引入 short-uuid,并坚决剔除已弃用的遗留包,是保持项目健康度的关键步骤。

如何選擇: uuid vs node-uuid vs short-uuid vs uuidv4

  • uuid:

    选择 uuid 作为默认方案。它是社区标准,遵循 RFC 4122 规范,拥有完整的类型定义和长期的维护承诺。适用于绝大多数需要唯一标识符的场景,包括前端会话 ID、后端主键生成及分布式追踪。

  • node-uuid:

    切勿在新项目中使用 node-uuid。该包已官方弃用多年,其功能已完全迁移至 uuid 包。继续使用会导致安全更新缺失及依赖警告,应立即迁移至 uuid。

  • short-uuid:

    选择 short-uuid 当且仅当你需要缩短 ID 长度时。例如生成公开可见的邀请码、短链接或为了减小数据库索引体积。它通过 Base57 等编码将标准 UUID 压缩,但牺牲了部分可读性和标准兼容性。

  • uuidv4:

    避免使用 uuidv4。这是一个功能单一的遗留包,通常只是 uuid 库的薄包装。现代 uuid 包已直接导出 v4 方法,单独引入 uuidv4 只会增加依赖树复杂度而无实际收益。

uuid 的 README

uuid CI Browser

For the creation of RFC9562 (formerly RFC4122) UUIDs

[!NOTE]

Starting with uuid@12 CommonJS is no longer supported. See implications and motivation for details.

Quickstart

1. Install

npm install uuid

2. Create a UUID

import { v4 as uuidv4 } from 'uuid';

uuidv4(); // ⇨ 'b18794e8-5d0d-417c-b361-ba38e78411b4'

For timestamp UUIDs, namespace UUIDs, and other options read on ...

API Summary

uuid.NILThe nil UUID string (all zeros)
uuid.MAXThe max UUID string (all ones)
uuid.parse()Convert UUID string to array of bytes
uuid.stringify()Convert array of bytes to UUID string
uuid.v1()Generate a version 1 (timestamp) UUID
uuid.v1ToV6()Convert a version 1 UUID to version 6
uuid.v3()Generate a version 3 (namespace w/ MD5) UUID
uuid.v4()Generate a version 4 (random) UUID
uuid.v5()Generate a version 5 (namespace w/ SHA-1) UUID
uuid.v6()Generate a version 6 (timestamp, reordered) UUID
uuid.v6ToV1()Convert a version 6 UUID to version 1
uuid.v7()Generate a version 7 (Unix Epoch time-based) UUID
uuid.v8()"Intentionally left blank"
uuid.validate()Test a string to see if it is a valid UUID
uuid.version()Detect RFC version of a UUID

API

uuid.NIL

The nil UUID string (all zeros).

Example:

import { NIL as NIL_UUID } from 'uuid';

NIL_UUID; // ⇨ '00000000-0000-0000-0000-000000000000'

uuid.MAX

The max UUID string (all ones).

Example:

import { MAX as MAX_UUID } from 'uuid';

MAX_UUID; // ⇨ 'ffffffff-ffff-ffff-ffff-ffffffffffff'

uuid.parse(str)

Convert UUID string to array of bytes

strA valid UUID String
returnsUint8Array[16]
throwsTypeError if str is not a valid UUID

[!NOTE] Ordering of values in the byte arrays used by parse() and stringify() follows the left ↠ right order of hex-pairs in UUID strings. As shown in the example below.

Example:

import { parse as uuidParse } from 'uuid';

// Parse a UUID
uuidParse('6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'); // ⇨
// Uint8Array(16) [
//   110, 192, 189, 127,  17,
//   192,  67, 218, 151,  94,
//    42, 138, 217, 235, 174,
//    11
// ]

uuid.stringify(arr[, offset])

Convert array of bytes to UUID string

arrArray-like collection of 16 values (starting from offset) between 0-255.
[offset = 0]Number Starting index in the Array
returnsString
throwsTypeError if a valid UUID string cannot be generated

[!NOTE] Ordering of values in the byte arrays used by parse() and stringify() follows the left ↠ right order of hex-pairs in UUID strings. As shown in the example below.

Example:

import { stringify as uuidStringify } from 'uuid';

const uuidBytes = Uint8Array.of(
  0x6e,
  0xc0,
  0xbd,
  0x7f,
  0x11,
  0xc0,
  0x43,
  0xda,
  0x97,
  0x5e,
  0x2a,
  0x8a,
  0xd9,
  0xeb,
  0xae,
  0x0b
);

uuidStringify(uuidBytes); // ⇨ '6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'

uuid.v1([options[, buffer[, offset]]])

Create an RFC version 1 (timestamp) UUID

[options]Object with one or more of the following properties:
[options.node = (random) ]RFC "node" field as an Array[6] of byte values (per 4.1.6)
[options.clockseq = (random)]RFC "clock sequence" as a Number between 0 - 0x3fff
[options.msecs = (current time)]RFC "timestamp" field (Number of milliseconds, unix epoch)
[options.nsecs = 0]RFC "timestamp" field (Number of nanoseconds to add to msecs, should be 0-10,000)
[options.random = (random)]Array of 16 random bytes (0-255) used to generate other fields, above
[options.rng]Alternative to options.random, a Function that returns an Array of 16 random bytes (0-255)
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer
throwsError if more than 10M UUIDs/sec are requested

Example:

import { v1 as uuidv1 } from 'uuid';

uuidv1(); // ⇨ '57fd0000-c7d3-11ef-841d-514d2167fc5b'

Example using options:

import { v1 as uuidv1 } from 'uuid';

const options = {
  node: Uint8Array.of(0x01, 0x23, 0x45, 0x67, 0x89, 0xab),
  clockseq: 0x1234,
  msecs: new Date('2011-11-01').getTime(),
  nsecs: 5678,
};
uuidv1(options); // ⇨ '710b962e-041c-11e1-9234-0123456789ab'

uuid.v1ToV6(uuid)

Convert a UUID from version 1 to version 6

import { v1ToV6 } from 'uuid';

v1ToV6('92f62d9e-22c4-11ef-97e9-325096b39f47'); // ⇨ '1ef22c49-2f62-6d9e-97e9-325096b39f47'

uuid.v3(name, namespace[, buffer[, offset]])

Create an RFC version 3 (namespace w/ MD5) UUID

API is identical to v5(), but uses "v3" instead.

[!IMPORTANT] Per the RFC, "If backward compatibility is not an issue, SHA-1 [Version 5] is preferred."

uuid.v4([options[, buffer[, offset]]])

Create an RFC version 4 (random) UUID

[options]Object with one or more of the following properties:
[options.random]Array of 16 random bytes (0-255)
[options.rng]Alternative to options.random, a Function that returns an Array of 16 random bytes (0-255)
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer

Example:

import { v4 as uuidv4 } from 'uuid';

uuidv4(); // ⇨ 'b18794e8-5d0d-417c-b361-ba38e78411b4'

Example using predefined random values:

import { v4 as uuidv4 } from 'uuid';

const v4options = {
  random: Uint8Array.of(
    0x10,
    0x91,
    0x56,
    0xbe,
    0xc4,
    0xfb,
    0xc1,
    0xea,
    0x71,
    0xb4,
    0xef,
    0xe1,
    0x67,
    0x1c,
    0x58,
    0x36
  ),
};
uuidv4(v4options); // ⇨ '109156be-c4fb-41ea-b1b4-efe1671c5836'

uuid.v5(name, namespace[, buffer[, offset]])

Create an RFC version 5 (namespace w/ SHA-1) UUID

nameString | Array
namespaceString | Array[16] Namespace UUID
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer

[!NOTE] The RFC DNS and URL namespaces are available as v5.DNS and v5.URL.

Example with custom namespace:

import { v5 as uuidv5 } from 'uuid';

// Define a custom namespace.  Readers, create your own using something like
// https://www.uuidgenerator.net/
const MY_NAMESPACE = '1b671a64-40d5-491e-99b0-da01ff1f3341';

uuidv5('Hello, World!', MY_NAMESPACE); // ⇨ '630eb68f-e0fa-5ecc-887a-7c7a62614681'

Example with RFC URL namespace:

import { v5 as uuidv5 } from 'uuid';

uuidv5('https://www.w3.org/', uuidv5.URL); // ⇨ 'c106a26a-21bb-5538-8bf2-57095d1976c1'

uuid.v6([options[, buffer[, offset]]])

Create an RFC version 6 (timestamp, reordered) UUID

This method takes the same arguments as uuid.v1().

import { v6 as uuidv6 } from 'uuid';

uuidv6(); // ⇨ '1efc7d35-7fd0-6000-841d-504d2167fc5b'

Example using options:

import { v6 as uuidv6 } from 'uuid';

const options = {
  node: [0x01, 0x23, 0x45, 0x67, 0x89, 0xab],
  clockseq: 0x1234,
  msecs: new Date('2011-11-01').getTime(),
  nsecs: 5678,
};
uuidv6(options); // ⇨ '1e1041c7-10b9-662e-9234-0123456789ab'

uuid.v6ToV1(uuid)

Convert a UUID from version 6 to version 1

import { v6ToV1 } from 'uuid';

v6ToV1('1ef22c49-2f62-6d9e-97e9-325096b39f47'); // ⇨ '92f62d9e-22c4-11ef-97e9-325096b39f47'

uuid.v7([options[, buffer[, offset]]])

Create an RFC version 7 (random) UUID

[options]Object with one or more of the following properties:
[options.msecs = (current time)]RFC "timestamp" field (Number of milliseconds, unix epoch)
[options.random = (random)]Array of 16 random bytes (0-255) used to generate other fields, above
[options.rng]Alternative to options.random, a Function that returns an Array of 16 random bytes (0-255)
[options.seq = (random)]32-bit sequence Number between 0 - 0xffffffff. This may be provided to help ensure uniqueness for UUIDs generated within the same millisecond time interval. Default = random value.
[buffer]Uint8Array or Uint8Array subtype (e.g. Node.js Buffer). If provided, binary UUID is written into the array, starting at offset
[offset = 0]Number Index to start writing UUID bytes in buffer
returnsUUID String if no buffer is specified, otherwise returns buffer

Example:

import { v7 as uuidv7 } from 'uuid';

uuidv7(); // ⇨ '01941f29-7c00-73e4-a310-744d2167fc5b'

uuid.v8()

"Intentionally left blank"

[!NOTE] Version 8 (experimental) UUIDs are "for experimental or vendor-specific use cases". The RFC does not define a creation algorithm for them, which is why this package does not offer a v8() method. The validate() and version() methods do work with such UUIDs, however.

uuid.validate(str)

Test a string to see if it is a valid UUID

strString to validate
returnstrue if string is a valid UUID, false otherwise

Example:

import { validate as uuidValidate } from 'uuid';

uuidValidate('not a UUID'); // ⇨ false
uuidValidate('6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'); // ⇨ true

Using validate and version together it is possible to do per-version validation, e.g. validate for only v4 UUIds.

import { version as uuidVersion } from 'uuid';
import { validate as uuidValidate } from 'uuid';

function uuidValidateV4(uuid) {
  return uuidValidate(uuid) && uuidVersion(uuid) === 4;
}

const v1Uuid = 'd9428888-122b-11e1-b85c-61cd3cbb3210';
const v4Uuid = '109156be-c4fb-41ea-b1b4-efe1671c5836';

uuidValidateV4(v4Uuid); // ⇨ true
uuidValidateV4(v1Uuid); // ⇨ false

uuid.version(str)

Detect RFC version of a UUID

strA valid UUID String
returnsNumber The RFC version of the UUID
throwsTypeError if str is not a valid UUID

Example:

import { version as uuidVersion } from 'uuid';

uuidVersion('45637ec4-c85f-11ea-87d0-0242ac130003'); // ⇨ 1
uuidVersion('6ec0bd7f-11c0-43da-975e-2a8ad9ebae0b'); // ⇨ 4

[!NOTE] This method returns 0 for the NIL UUID, and 15 for the MAX UUID.

Command Line

UUIDs can be generated from the command line using uuid.

$ npx uuid
ddeb27fb-d9a0-4624-be4d-4615062daed4

The default is to generate version 4 UUIDS, however the other versions are supported. Type uuid --help for details:

$ npx uuid --help

Usage:
  uuid
  uuid v1
  uuid v3 <name> <namespace uuid>
  uuid v4
  uuid v5 <name> <namespace uuid>
  uuid v7
  uuid --help

Note: <namespace uuid> may be "URL" or "DNS" to use the corresponding UUIDs
defined by RFC9562

options Handling for Timestamp UUIDs

Prior to uuid@11, it was possible for options state to interfere with the internal state used to ensure uniqueness of timestamp-based UUIDs (the v1(), v6(), and v7() methods). Starting with uuid@11, this issue has been addressed by using the presence of the options argument as a flag to select between two possible behaviors:

  • Without options: Internal state is utilized to improve UUID uniqueness.
  • With options: Internal state is NOT used and, instead, appropriate defaults are applied as needed.

Support

Browsers: uuid builds are tested against the latest version of desktop Chrome, Safari, Firefox, and Edge. Mobile versions of these same browsers are expected to work but aren't currently tested.

Node: uuid builds are tested against node (LTS releases), plus one prior. E.g. At the time of this writing node@20 is the "maintenance" release and node@24 is the "current" release, so uuid supports node@20-node@24.

Typescript: TS versions released within the past two years are supported. source

Known issues

"getRandomValues() not supported"

This error occurs in environments where the standard crypto.getRandomValues() API is not supported. This issue can be resolved by adding an appropriate polyfill:

React Native / Expo

  1. Install react-native-get-random-values
  2. Import it before uuid. Since uuid might also appear as a transitive dependency of some other imports it's safest to just import react-native-get-random-values as the very first thing in your entry point:
import 'react-native-get-random-values';
import { v4 as uuidv4 } from 'uuid';

Generated from README_js.md by runmd