Version 4 random UUIDs are the common web default; understand that UUIDs are unique with overwhelming probability, not a proof of secrecy. Do not treat them as API keys. Developers generate rows for local databases, QA builds bulk test entities, and tech writers sprinkle example IDs into docs that should not reuse production values.

Pair with Hash Generator when you need deterministic digests instead of random IDs, and with Password Generator when the secret must be unguessable for authentication. Keep generator output out of public screenshots if it somehow maps to real tenants in your staging notes.

Generate fresh IDs for each environment fixtures so staging data never collides with production support notes. Document whether your API expects hyphenated canonical form. Do not put UUIDs in URLs as if they were capability tokens — authorise separately. Log generated test UUIDs in the QA ticket when reporting bugs so engineers can find the exact fixture rows.

Prefer generating identifiers close to the write path in production systems, and use this page for fixtures, docs, and demos. Mixing hand-minted UUIDs into production admin tools without audit logs creates forensic headaches.

Prohibit nil UUIDs and well-known demo UUIDs from production seed scripts. Collisions with sample data found on the public internet have caused embarrassing support tickets when customers see famous example identifiers in their accounts.

Generate identifiers for fixtures freely, but connect production generation to the service that owns the aggregate root. Client-side UUID creation is fine for offline drafts when the server accepts client ids; otherwise you risk orphan records. Document the ownership rule in your API guidelines next to example UUIDs from this page.