Why anyone would want a UUID that is not random#
A v4 UUID is random on purpose — useful as a unique identifier with no relationship to anything else. v5 solves a different problem: turning an existing piece of data (a URL, a domain, an email) into a stable UUID without keeping a lookup table anywhere. Two independent systems that both compute uuidV5(sameNamespace, "[email protected]") get the identical UUID without ever talking to each other — the value is a pure function of its inputs, not a lookup.
What the namespace is actually for#
The namespace exists so that the same name string produces a different UUID depending on what kind of thing it names — uuidV5(DNS_NAMESPACE, "example.com") and uuidV5(URL_NAMESPACE, "example.com") are guaranteed to differ, even though the name text is identical, because the namespace UUID is mixed into the hash before the name. The four standard namespaces (DNS, URL, OID, X.500) exist for interoperability with other systems generating v5 UUIDs for the same kinds of data; a custom namespace works identically for anything that does not fit those categories — pick any UUID and use it consistently.
Why this uses SHA-1, and why that is fine here#
SHA-1 is considered broken for cryptographic purposes — an attacker can construct two different inputs with the same hash — but that weakness is irrelevant to what v5 uses it for. Nothing here depends on SHA-1 being uncrackable; it is used purely as a well-distributed mixing function to turn (namespace, name) into 128 semi-random-looking bits, not as a security mechanism. The RFC deliberately kept SHA-1 in the v5 algorithm rather than requiring implementations to migrate to a newer hash, specifically because collision resistance was never the property v5 relies on.