How is this different from a version 4 UUID?

Version 4 is random, so it is different every time and you have to store it. Version 5 is derived from what you put in, so it is the same every time and you can recompute it instead of storing it. That makes it the right choice for deriving an id from something you already have, such as a URL.

No. It is a one way function, so the UUID does not reveal the name. It is also not a secret: anyone who guesses the name can compute the same UUID, so do not use one as an access token.

Why does it use SHA-1 when SHA-1 is broken?

Because the standard specifies it, and this is an identifier rather than a security guarantee. Version 5 is defined as SHA-1 of the namespace and the name, and using anything else would produce values that disagree with every other implementation. Collision resistance is not what this relies on.

UUID v5 Generator

The same input always gives the same UUID.

Name

Namespace

Or a namespace of your own

The same input always gives the same UUID.

How to use it

Enter the name. A domain, a URL, or any string you want a stable identifier for.
Choose the namespace. One of the four from the standard, or supply your own UUID.
Use it anywhere. The same name and namespace always produce this same UUID.

When you would use this

Most UUID generators produce version 4, which is random. That is the right answer when you need an identifier nothing can predict, and the wrong one when you need the same input to keep giving the same identifier. Version 5 derives the UUID from a namespace and a name. Feed it a domain and you get an identifier for that domain, the same one, forever, on any machine and in any language. That means you can recompute it rather than storing it, which removes a whole category of synchronisation problem. The four predefined namespaces come from the standard: DNS for domain names, URL for addresses, OID and X500 for directory identifiers. You can also supply a UUID of your own as a namespace, which is what you want when generating ids inside your own system: it keeps your identifiers from colliding with anyone else's derived from the same names. The algorithm is SHA-1, because the standard says so. That is not a security decision, it is an interoperability one: the output here matches the published test vectors and therefore matches every other correct implementation.

Questions

How is this different from a version 4 UUID?: Version 4 is random, so it is different every time and you have to store it. Version 5 is derived from what you put in, so it is the same every time and you can recompute it instead of storing it. That makes it the right choice for deriving an id from something you already have, such as a URL.
Is it reversible?: No. It is a one way function, so the UUID does not reveal the name. It is also not a secret: anyone who guesses the name can compute the same UUID, so do not use one as an access token.
Why does it use SHA-1 when SHA-1 is broken?: Because the standard specifies it, and this is an identifier rather than a security guarantee. Version 5 is defined as SHA-1 of the namespace and the name, and using anything else would produce values that disagree with every other implementation. Collision resistance is not what this relies on.