When you're writing server-side JavaScript, Node.js gives you a way to generate a UUID without installing anything — the crypto module's randomUUID() method returns a random, RFC 4122-compliant identifier in a single call. It's been part of Node's core since v14.17.0, so there's no dependency to audit or keep updated, just a built-in import. Below you'll find copy-paste ready code for generating a Node.js UUID in both CommonJS and ES Modules, validating a UUID string, and reaching for the uuid npm package when you need a version the built-in crypto module doesn't cover.
How to Generate a UUID in Node.js
The standard way to generate a UUID in Node.js is crypto.randomUUID(), which has shipped in Node's core since v14.17.0 (stable without a flag since v16.7.0) and needs no npm install. It returns a random, RFC 4122-compliant UUID as a plain string, ready to use in either module system. With Composer installed, a php uuid object built from random_bytes() implements UuidInterface and converts to text with toString().
const { randomUUID } = require('crypto');
const id = randomUUID();
console.log(id);
// Output: 550e8400-e29b-41d4-a716-446655440000import { randomUUID } from 'node:crypto';
const id = randomUUID();
console.log(id);
// Output: 550e8400-e29b-41d4-a716-446655440000Explanation
require('crypto')loads Node's built-in crypto module — available in every Node.js install since v14.17.0, no third-party package required.randomUUID()generates a version 4 UUID using the operating system's cryptographically secure random number generator, the same algorithm browsers expose via the Web Crypto API.- The ES Modules example imports from
node:crypto, the recommended prefixed specifier for core modules; the barecryptospecifier still works butnode:cryptomakes the import unambiguous. - The return value is already a string, so you can store it, log it, or serialize it directly without any extra conversion step.
Convert a String to a UUID in Node.js
Node's crypto module has no dedicated UUID type or parser — once randomUUID() returns, a UUID is just a string. What you usually need instead is validation: confirming that a string from a request body, config file, or database row is actually a well-formed UUID before you trust it. On older Node versions a typescript uuid file imports randomUUID from node:crypto, with @types/node supplying the typings.
const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
function isValidUuid(value) {
return UUID_REGEX.test(value);
}
console.log(isValidUuid('550e8400-e29b-41d4-a716-446655440000')); // true
console.log(isValidUuid('not-a-uuid')); // falseimport { validate, version } from 'uuid';
const id = '550e8400-e29b-41d4-a716-446655440000';
console.log(validate(id)); // true
console.log(version(id)); // 4Explanation
- Node's built-in
cryptomodule has noparse()orisUuid()function — "converting" a string to a UUID really means checking that it matches the expected shape. - The regex enforces the RFC 4122 layout: 8-4-4-4-12 hex digits, with the version nibble restricted to
1-5and the variant nibble restricted to8,9,a, orb. - The
uuidpackage'svalidate()is a convenient drop-in when you already depend on it for generation, and its pairedversion()helper reports which UUID version a string actually is. - Either approach only confirms the string's format — neither one proves the UUID was generated by your own application.
Other Options for Generating UUIDs in Node.js
For any version besides v4, or on older Node runtimes where crypto.randomUUID() isn't available, the uuid npm package is the standard choice. Install it once and it covers generation and validation for v1, v3, v5, and v7 through simple named exports.
npm install uuidimport { v4 as uuidv4, v7 as uuidv7 } from 'uuid';
// Version 4 - random (same algorithm as crypto.randomUUID())
const id4 = uuidv4();
// Version 7 - Unix timestamp + random, sortable and index-friendly
const id7 = uuidv7();
console.log(id4, id7);Explanation
- The
uuidpackage exposes each version as a separate named export (v1,v3,v4,v5,v7), so you only import the functions you actually need. v7()encodes the current Unix millisecond timestamp in the most significant bits, which keeps generated IDs sortable and friendlier to database indexes than random v4 values.v5()hashes a namespace UUID and a name string with SHA-1, so the same two inputs always produce the same output — useful for deterministic, content-addressed identifiers.- Reach for this package instead of
crypto.randomUUID()only when you need a version other than v4, since v4 generation alone is already covered natively without a dependency.