UUID, ULID & Token Formats Cheat Sheet

Identifiers come in distinct families: time-ordered (ULID, UUIDv7), random (UUIDv4, NanoID), and hash/name-derived (UUIDv3/v5/v8). Choose by the property you need — sortability, randomness, or determinism.

UUID Versions at a Glance

Table

Version	Based on	Deterministic	Sortable	Notes
v1	MAC + timestamp	No	Roughly	Privacy leak (MAC address); use v7 instead
v3	MD5 of namespace+name	Yes	No	Legacy
v4	Random	No	No	Most common; not sortable
v5	SHA-1 of namespace+name	Yes	No	Preferred deterministic variant
v7	Unix ms timestamp + random	No	Yes	Time-ordered, collision-safe
v8	Custom	Configurable	Configurable	Experimental, vendor-defined

Example v4: f47ac10b-58cc-4372-a567-0e02b2c3d479 Example v7: 01901b2f-bd3a-7a3c-9f1e-2e4a5b6c7d8e

ULID

ULID is a 26-character Crockford-base32 string: 10 chars of UNIX timestamp (ms) + 16 chars of randomness. Sortable lexicographically and URL-safe.

text

01AN4Z07BY      2naidob2sample
└─ timestamp ─┘ └─ randomness ─┘
01AN4Z07BY79KA1307SR9XYNV

import { ulid } from "ulid";
const id = ulid(); // "01HHZ7XZJY..."

NanoID

NanoID is a compact random ID (21 chars by default, 64-bit alphabet) used widely in React/database defaults. Length and alphabet are configurable.

import { nanoid } from "nanoid";
nanoid();        // "V1StGXR8_Z5jdHi6B-myT"
nanoid(10);      // shorter, 10 chars

Token Generation

Random tokens for API keys, invites, and session tokens should use a CSPRNG, never Math.random.

// Node — 32 random bytes as base64url
import { randomBytes } from "node:crypto";
const token = randomBytes(32).toString("base64url"); // 43 chars

python

import secrets
token = secrets.token_urlsafe(32)   # ~43 chars

Table

Token type	Example	Entropy source
API key	`sk_live_4fC9...`	32+ random bytes
JWT	`eyJhbGciOi.JIUzI1NiIs...`	Signed claims, not random
BIP39 mnemonic	`abandon ability able...`	128–256 bits of entropy
Base58	`9zQ4vF...`	BTC-style alphabet

Common Pitfalls

[!WARNING] UUIDv1 embeds the MAC address and timestamp — an information leak. Prefer v4 for random or v7 for time-ordered.

[!TIP] For database primary keys that must sort by creation order, use ULID or UUIDv7 — both are lexicographically ordered and avoid the index fragmentation of random UUIDv4.