What is a UUID? — Universally Unique Identifier Explained

Definition

A UUID (Universally Unique Identifier), also known as a GUID (Globally Unique Identifier) in Microsoft terminology, is a 128-bit identifier standardized by the Open Software Foundation (OSF) as part of the Distributed Computing Environment (DCE) and later formalized in RFC 4122. UUIDs are designed to be unique across space and time — no two UUIDs should ever be the same, even when generated independently on different systems without centralized coordination.

UUIDs are widely used in software development for identifying resources, entities, records, and transactions where uniqueness must be guaranteed without a central authority.

UUID Format

A UUID is a 128-bit number typically represented as a 36-character string (32 hexadecimal digits separated by 4 hyphens) in the canonical 8-4-4-4-12 pattern:

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Each x is a hexadecimal digit (0-9, a-f). Here is an example UUID:

550e8400-e29b-41d4-a716-446655440000

The 128 bits are divided into fields:

The variant field (2 bits in byte 8) indicates the UUID layout and interpretation. RFC 4122 specifies variant bits 10xx, which covers the vast majority of UUIDs in use today.

The version field (4 bits in byte 6) indicates which generation algorithm was used.

UUID Versions

RFC 4122 defines several UUID versions, each using a different strategy for generating a unique identifier.

UUID v1 — Time-Based

UUID v1 generates identifiers using the current timestamp (100-nanosecond intervals since October 15, 1582) combined with the generating machine's MAC address.

• Source: Timestamp + clock sequence + MAC address
• Uniqueness: High within a machine; global across machines via MAC
• Privacy: Exposes the host MAC address and timestamp — a security concern
• Speed: Fast, sequential
• Collision risk: Near zero within the same machine

f47ac10b-58cc-1371-8567-0e02b2c3d479

Use case: Legacy systems, databases needing time-ordered indexing without v7 support.

UUID v3 — Name-Based (MD5)

UUID v3 generates identifiers by hashing a namespace UUID and a name string using MD5.

• Source: MD5 hash of namespace UUID + name
• Deterministic: Same name always produces the same UUID
• Length: 128 bits (MD5 output)
• Security: Not cryptographically secure

6ba7b810-9dad-31d0-80b4-00c04fd430c8

Use case: Generating deterministic identifiers from domain names, URLs, or object names within a known namespace.

UUID v4 — Random

UUID v4 generates identifiers using random or pseudo-random numbers. This is the most widely used UUID version.

• Source: Random bytes (122 random bits, 6 fixed variant/version bits)
• Uniqueness: Probabilistic — relies on random entropy
• Privacy: No system information exposed
• Speed: Very fast
• Collision risk: Extremely low (see below)

550e8400-e29b-41d4-a716-446655440000

Use case: Primary keys in modern applications, session identifiers, API keys, event IDs, any scenario where anonymity and simplicity matter.

UUID v5 — Name-Based (SHA-1)

UUID v5 is identical in concept to v3 but uses SHA-1 instead of MD5 for hashing.

• Source: SHA-1 hash of namespace UUID + name
• Deterministic: Same name always produces the same UUID
• Length: 128 bits (SHA-1 output truncated)
• Security: Better than v3

6ba7b810-9dad-51d0-80b4-00c04fd430c8

Use case: Same as v3, but preferred over v3 because SHA-1 is more collision-resistant than MD5.

UUID v7 — Time-Ordered

UUID v7 is a newer version (proposed in RFC 9562) that combines a Unix timestamp in milliseconds with random data, producing identifiers that are sortable by time.

• Source: Unix timestamp (ms) + random bits
• Uniqueness: Timestamp + entropy
• Ordering: Monotonically increasing — ideal for database indexes
• Privacy: No MAC address exposure
• Speed: Fast

018f3a6b-7a8c-7b00-b5e8-9e6c12d3f4a5

Use case: Modern database primary keys (especially in MySQL/PostgreSQL with clustered indexes), distributed tracing, event sourcing.

UUID Version Comparison

UUID vs Other Identifier Formats

UUID vs ULID

ULID (Universally Unique Lexicographically Sortable Identifier) is a 128-bit identifier designed to be sortable and URL-safe.

ULIDs are preferred when you need compact, sortable identifiers without hyphens.

UUID vs Snowflake ID

Snowflake IDs (pioneered by Twitter/X) are 64-bit identifiers used in distributed systems.

Snowflake IDs are ideal for high-throughput distributed systems where storage efficiency matters and worker coordination is feasible.

UUID vs NanoID

NanoID is a modern, URL-safe, compact unique ID generator.

NanoID is preferred for URL shorteners, short public identifiers, and when you need compact tokens with a custom alphabet.

Collision Probability

The probability of a UUID collision depends on the version and the number of generated IDs.

UUID v4

UUID v4 uses 122 random bits. The probability of at least one collision after generating n UUIDs follows the birthday problem approximation:

• After 2.71 trillion UUIDs: ~50% collision probability
• After 1 billion UUIDs: ~0.0000000001% (essentially zero)
• After 100 billion UUIDs: ~0.000001%

To put this in perspective: generating 1 billion UUIDs per second for the next 100 years would give you about a 50% chance of a single collision.

UUID v7

UUID v7 uses 74 random bits (plus a 48-bit timestamp). Within the same millisecond, there are 2⁷⁴ possible values — equivalent to v4's collision resistance on a per-millisecond basis.

Deterministic (v3/v5)

Collisions are theoretically possible but practically impossible when using unique namespace + name pairs with well-distributed hash functions.

The RFC 4122 Standard

RFC 4122 (July 2005) is the IETF standard that defines UUIDs. Key points:

• Defines the UUID format, variant, and version fields
• Specifies v1 (time-based), v3 (MD5 name-based), v4 (random), and v5 (SHA-1 name-based)
• Defines four namespace UUIDs: DNS, URL, OID, and X.500
• Updated by RFC 9562 (May 2024), which adds UUID v6, v7, and v8
• Widely implemented in all major programming languages and operating systems

Common Use Cases

Database Primary Keys

UUIDs make excellent primary keys in databases, especially in distributed systems where auto-increment integers cannot guarantee uniqueness across shards or regions. UUID v7 is particularly well-suited because it is time-ordered and avoids index fragmentation.

Distributed Systems

In microservices and distributed architectures, services running on different nodes can generate UUIDs independently without synchronization — no central sequence server required.

Session Identifiers

UUID v4 is commonly used for web session IDs because it is random and reveals no information about the server or user.

API Keys

UUIDs serve as API keys, request correlation IDs, event IDs in event sourcing, and message IDs in message queues.

File and Asset Identifiers

Content management systems and cloud storage platforms use UUIDs to reference files, images, documents, and media assets without name collisions.

Generating UUIDs

Most programming languages include UUID generation in their standard libraries or have widely available third-party packages:

• JavaScript/TypeScript: crypto.randomUUID() (Node.js 19+), uuid npm package
• Python: uuid.uuid4(), uuid.uuid1(), uuid.uuid7() (Python 3.14+)
• Java: java.util.UUID.randomUUID()
• Go: github.com/google/uuid
• Rust: uuid crate
• PostgreSQL: gen_random_uuid(), uuid_generate_v4()
• MySQL: UUID(), UUID_TO_BIN()
• SQLite: randomblob(16) with formatting

LangStop UUID Tools

• UUID v4 Generator — Generate random UUIDs (RFC 4122)
• UUID v7 Generator — Generate time-ordered UUIDs (RFC 9562)
• UUID v1 Generator — Generate time-based UUIDs
• ULID Generator — Generate sortable ULID identifiers
• GUID Generator — Generate GUID-formatted identifiers
• Hash Generator — Generate cryptographic hashes (MD5, SHA-1, SHA-256)