A UUID (universally unique identifier) is a 128-bit value used to identify things without a central authority handing out numbers. It's written as 32 hexadecimal digits in five groups, like 3f2b8c1e-9a4d-4c7e-8f01-2b6d5e7a9c10.
Reading a UUID
- The layout is 8-4-4-4-12 hex digits.
- The first digit of the third group is the version. In 3f2b8c1e-9a4d-4c7e-..., the 4 marks version 4.
- The first digit of the fourth group encodes the variant (usually 8, 9, a, or b for standard UUIDs).
The main versions
- v1: based on a timestamp and the machine's MAC address. Sortable-ish, but it can leak the machine and creation time.
- v3 and v5: name-based; hash a namespace plus a name (v3 with MD5, v5 with SHA-1) to get the same UUID every time for the same input.
- v4: random. The most common; 122 of its 128 bits are random.
- v6 and v7: time-ordered versions standardized in RFC 9562 (2024). v7 puts a millisecond timestamp first followed by random bits.
Will two UUIDs ever collide?
With v4 there are 2^122, about 5.3 x 10^36, possible values. Even generating a billion UUIDs, the chance of any collision is on the order of 10^-19, so for practical purposes collisions are not a concern when a good random source is used.
Why v7 is nice for databases
Random v4 keys land all over a B-tree index, which causes page splits and poorer cache locality on large tables. Time-ordered UUIDs (v7) are roughly sequential, so inserts append near the end of the index, like an auto-increment key, while still being globally unique and generated without coordination.
Which should you use?
- General unique IDs: v4 is simple and universally supported.
- Primary keys in large databases: consider v7 for better index behavior.
- Deterministic IDs from a name: v5.
- Avoid v1 if you don't want to expose timing or machine details.
A UUID is not a secret
UUIDs are identifiers, not authorization tokens. Don't rely on them being hard to guess as your only access control; use proper authentication, and generate secrets with a cryptographic random generator.
Frequently asked questions
What is a UUID?
A 128-bit identifier written as 32 hex digits in the 8-4-4-4-12 format, designed to be unique without central coordination.
Can two UUIDs be the same?
In theory yes, but with random v4 UUIDs the probability is so small it is negligible in practice.
What is the difference between UUID v4 and v7?
v4 is entirely random. v7 begins with a timestamp, so values sort roughly by creation time, which is better for database indexes.
Are UUIDs safe to use as security tokens?
Not by themselves. Use a cryptographically secure random token for secrets and proper access control for resources.
Try it: UUID Generator — free, runs in your browser, nothing is uploaded.
Originally published at ilovekit.app.
Top comments (0)