Use the browser’s cryptographic APIs to create UUIDs directly in frontend JavaScript. Client-side generation is fast and decentralized, but every identifier accepted by an API still needs server-side validation, uniqueness enforcement and authorization.
Key takeaways
- Use crypto.randomUUID() or crypto.getRandomValues(), never Math.random().
- Secure browser contexts provide the modern cryptographic API surface.
- Client generation does not replace backend validation or access control.
For implementation context, continue with No Backend, Offline UUIDs, and JavaScript. These pages cover the closest generator, comparison, validation or storage decisions without repeating this guide.
Generate with Web Crypto
Modern browsers expose crypto.randomUUID() for UUID v4 and crypto.getRandomValues() for reviewed implementations of other formats. These sources are designed for cryptographic-quality randomness and avoid a network round trip.
Do not add a Math.random fallback. If the secure random source is unavailable, fail clearly rather than generating identifiers with weaker and misleading guarantees.
Choose the creation moment
Generate an ID when a draft or record is created, not on every component render. In React, use an initializer, event handler or data-layer function so rerenders do not silently replace the identifier.
The server still has responsibilities
Treat a client-generated UUID as untrusted input. Parse it, enforce the allowed version where relevant, keep a database unique constraint and check whether the caller may act on the referenced object.