What Is a UUID?
A UUID (Universally Unique Identifier) is a 128-bit value used to uniquely identify information in computer systems. UUIDs are standardized by RFC 4122 and are represented as 32 hexadecimal digits displayed in five groups separated by hyphens, following the format xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. The total number of possible UUID v4 values is approximately 5.3 × 1036, making collisions virtually impossible in practice.
UUIDs were originally created to enable distributed systems to generate unique identifiers without a central coordinating authority. Unlike auto-incrementing integers from a database sequence, UUIDs can be created independently on different machines with an astronomically low probability of duplication. This property makes them invaluable in modern software architecture.
UUID Versions Explained (v1 through v5)
The UUID specification defines five versions, each using a different generation strategy:
- UUID v1 — Based on the current timestamp and the MAC address of the generating machine. Version 1 UUIDs are time-ordered, which can help with database index performance, but they expose hardware information and the time of creation, which may be a privacy concern.
- UUID v2 — Similar to v1 but incorporates a local domain identifier (such as a POSIX UID or GID). Version 2 UUIDs are rarely used in practice and are not widely supported by most programming languages and libraries.
- UUID v3 — Generated by hashing a namespace identifier and a name using MD5. Given the same namespace and name, v3 always produces the same UUID, making it deterministic and useful for consistent identifier generation from known inputs.
- UUID v4 — Generated using random or pseudo-random numbers. This is the most commonly used version because it requires no external state, no coordination, and no input data. The tool on this page generates UUID v4 values using the browser's cryptographically secure
crypto.randomUUID()API. - UUID v5 — Identical in concept to v3 but uses SHA-1 instead of MD5 for hashing. UUID v5 is generally preferred over v3 when a deterministic, name-based UUID is needed because SHA-1 provides better collision resistance than MD5.
UUID v4 in Detail
UUID version 4 is by far the most widely adopted variant. In a v4 UUID, 122 of the 128 bits are randomly generated. The remaining 6 bits are used to encode the version number (4, placed in the high nibble of the 7th byte) and the variant (the two most significant bits of the 9th byte are set to 10).
Because the randomness comes from a cryptographically secure source (such as crypto.getRandomValues() or crypto.randomUUID() in modern browsers), the probability of generating two identical UUIDs is negligibly small. You would need to generate approximately 2.71 × 1018 UUIDs before reaching a 50% probability of a single collision — a scenario that is practically impossible in any real-world application.
A typical UUID v4 looks like this: f47ac10b-58cc-4372-a567-0e02b2c3d479. Notice that the first digit of the third group is always 4, indicating the version. The first digit of the fourth group will be one of 8, 9, a, or b, indicating the variant.
Common Use Cases for UUIDs
Database Primary Keys
Many modern applications use UUIDs as primary keys instead of auto-incrementing integers. This approach avoids problems with ID conflicts when merging data from multiple sources or database shards. PostgreSQL has a native uuid type, and MySQL supports UUIDs via CHAR(36) or BINARY(16) columns. When using UUIDs as primary keys, consider UUID v7 (a newer time-ordered variant) for better index locality if your database supports it.
API Request and Correlation IDs
REST and GraphQL APIs frequently use UUIDs as resource identifiers and correlation IDs. Assigning a UUID to each API request allows developers to trace a request through multiple microservices in distributed logging systems. This pattern is essential for debugging production issues in systems with dozens or hundreds of services.
Distributed Systems and Event Sourcing
In distributed architectures, multiple nodes often need to create records simultaneously without coordination. UUIDs solve this elegantly because each node can independently generate identifiers without risk of collision. Event sourcing systems use UUIDs to uniquely tag every event in the event store, ensuring that replays and projections remain consistent across the entire system.
File and Session Identifiers
UUIDs are commonly used to name uploaded files in object storage (such as AWS S3 or Google Cloud Storage) to prevent naming conflicts and avoid exposing sequential identifiers. Similarly, session tokens and temporary resource identifiers are often based on UUIDs to ensure uniqueness without requiring a centralized counter.
UUID vs. GUID: Is There a Difference?
The terms UUID and GUID (Globally Unique Identifier) are often used interchangeably, and for most purposes they refer to the same thing. The term GUID originated in the Microsoft ecosystem and is commonly seen in .NET, COM, and Windows APIs. The term UUID comes from the Open Software Foundation (OSF) and is the standard name used in RFC 4122.
The only notable difference is formatting: Microsoft tools sometimes display GUIDs with curly braces (e.g., {f47ac10b-58cc-4372-a567-0e02b2c3d479}) and may use uppercase letters, while UUIDs in most other contexts are displayed without braces in lowercase. Internally, the 128-bit binary representation is identical.
Frequently Asked Questions
Are UUID v4 values truly unique?
UUID v4 values are not guaranteed to be unique in the mathematical sense, but the probability of collision is so astronomically low that it is effectively zero for all practical applications. With 122 random bits, you would need to generate billions of UUIDs per second for decades before expecting a single duplicate.
Can I use UUIDs as database primary keys?
Yes. UUIDs work well as primary keys, especially in distributed systems. The main trade-off is performance: random UUIDs can cause more page splits in B-tree indexes compared to sequential integers. If this is a concern, consider UUID v7 (time-ordered) or use your database's native UUID type with optimized storage (e.g., BINARY(16) in MySQL instead of CHAR(36)).
Is this tool safe to use for security-sensitive identifiers?
This tool uses your browser's crypto.randomUUID() API, which is backed by a cryptographically secure pseudo-random number generator (CSPRNG). The generated UUIDs never leave your browser — all processing happens client-side. However, UUIDs are not designed to be secrets; if you need unpredictable tokens for authentication or authorization, consider using a dedicated secret token generator with higher entropy.
What is the difference between UUID v4 and UUID v7?
UUID v7 is a newer variant (defined in RFC 9562, published in 2024) that embeds a Unix timestamp in the first 48 bits, making the values sortable by creation time. The remaining bits are random. UUID v7 combines the benefits of time-ordered identifiers (better database index performance) with the simplicity of random generation (no MAC address or coordinating server needed). If your use case benefits from sortable IDs, UUID v7 is worth considering.
How do I validate a UUID string?
A valid UUID v4 string matches the regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i. The key markers are the 4 at position 13 (version) and one of 8, 9, a, or b at position 19 (variant). Most programming languages also provide built-in UUID parsing and validation utilities.