UUID Best Practices
A checklist of principles worth following when working with UUIDs in production.
Choosing a version
Unless you have a specific reason not to, use v4 for general-purpose IDs and v7 when ordering matters, such as a database primary key. Only reach for v3 or v5 when you need a reproducible, name-based ID.
Consistent format
Within a single system, standardize on one casing and hyphenation format. Lowercase with hyphens is the most common standard and reduces confusion in storage, comparison, and logs.
Separate from security
A UUID is just a unique identifier, not a secret. For values that must be hard to guess, such as session or password-reset tokens, use a dedicated security token instead of a UUID, and always generate it from a cryptographic source of randomness.
Validation
Validate the format and version of any UUID you receive from an external source before using it. Checking the version and variant with an inspector lets you quickly catch malformed input or a version you weren't expecting.