UUID v4 generator and checker

Format

xxxxxxxx-xxxx-4xxx-Nxxx-xxxxxxxxxxxx
               |    |
               |    N is 8, 9, a or b: variant bits 10
               version 4

The fallback path, used where crypto.randomUUID is missing, draws 16 bytes from crypto.getRandomValues. It then sets byte[6] = (byte[6] & 0x0f) | 0x40 and byte[8] = (byte[8] & 0x3f) | 0x80. randomUUID only exists in secure contexts, meaning https pages and localhost.

Pitfalls

Random UUIDs make poor clustered primary keys. Inserts land all over a B-tree index and fragment it. Version 7 puts a millisecond timestamp in the high bits and sorts by creation time, which suits that case better.

Collisions are not a practical concern: with 122 random bits you need around 2.7 × 10^18 UUIDs before the chance of a single duplicate reaches one half. A broken random source is the realistic risk, such as a seeded Math.random or a cloned virtual machine image.

Compare UUIDs case-insensitively. RFC 9562 asks for lowercase output, but uppercase input is valid.