UUID Use Case

UUID Nonce

A nonce is a value used only once. A v4 UUID is a convenient, collision-free nonce for protocol handshakes and inline script allow-lists.

One-timeReplay protectionv4

Generated locally with the Web Crypto API — nothing leaves your browser.

What Is UUID Nonce?

How to generate

  1. Generate a fresh v4 UUID for every exchange or response.
  2. Include it in the signed message or CSP header.
  3. Reject any message whose nonce was seen before.

Use Cases

Code Examples

JavaScript
const nonce = crypto.randomUUID();
res.setHeader('Content-Security-Policy', `script-src 'nonce-${nonce}'`);

Frequently Asked Questions

Nonce vs CSRF token?
Both are random one-time values; a nonce is the general crypto term, CSRF tokens are a specific use for form protection.
Must a nonce be a UUID?
No, but a v4 UUID is a handy, guaranteed-unique source of randomness.

Related tools