What is a UUID?
A UUID (universally unique identifier, also called a GUID) is a 128-bit ID written as 32 hex digits, like
550e8400-e29b-41d4-a716-446655440000. They're random enough that anyone can make one without
checking with anyone else, and still never expect to see a duplicate.
Version 4 or version 7?
Version 4 is 122 random bits: the usual choice, and it gives nothing away about when or where it was made. Version 7 (from RFC 9562, 2024) starts with the time in milliseconds, followed by 74 random bits. Because they sort in creation order, v7 UUIDs make better database keys: new rows go at the end of an index instead of all over it. The catch is that anyone can read the creation time from a v7, so use v4 when that matters.
Random tokens
For an API key or secret, 32 random bytes (256 bits) is plenty, and 16 bytes (128 bits) is enough for most things. Hex is the easiest to handle, base64url is shorter and safe in URLs, and letters and digits avoid every symbol. The strength line shows how many bits of randomness a token has. Everything here comes from your browser's cryptographically secure random generator, and nothing is sent anywhere.