UUID Generator

What is UUID?

A UUID (Universally Unique Identifier) is a 128-bit identifier standardized by RFC 4122. It follows the format xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx, where the 4 digit marks the version and the y marks the variant.

UUIDs v4 come out of random bytes, which keeps the odds of a collision astronomically low. No wonder they've become a go-to for primary keys in databases, session identifiers and API tokens.

What a UUID really is

A UUID — Universally Unique Identifier — is a 128-bit number rendered as 32 hexadecimal characters in five groups separated by hyphens, like 550e8400-e29b-41d4-a716-446655440000. The same construct is called GUID by Microsoft and ULID/KSUID by some alternative encodings, but they all answer the same question: how do I generate an identifier without coordinating with a central server and still trust it will not collide with another? The standard is currently defined by RFC 9562, published in May 2024, which superseded RFC 4122.

The math behind v4 is striking: with 122 random bits, you would need to generate roughly 2.71 quintillion UUIDs before the probability of a single collision reaches one in a billion. In practice the limiting factor is the quality of your random number source, not the address space. Use a cryptographically secure RNG (crypto.randomUUID() in modern browsers, uuid_generate_v4 in PostgreSQL, java.util.UUID.randomUUID()) and the guarantee holds.

Versions and when to use each

v4 is purely random and remains the default for general-purpose IDs when ordering does not matter. v7, introduced in RFC 9562, prepends a 48-bit Unix-millisecond timestamp to 74 random bits — the values sort chronologically, which dramatically improves B-tree index locality in databases and is now the recommended choice for new primary keys. v1 embeds the MAC address of the host and is discouraged because it leaks hardware identity. v5 derives the UUID from a namespace plus a name using SHA-1 — useful when you need the same input to always produce the same UUID.

FAQ

Are UUIDs truly unique? Not by construction — they are statistically unique. With v4 the collision probability is negligible for any realistic workload, but if you generate UUIDs from a weak RNG (such as Math.random) the guarantee falls apart.

Should I use UUID or auto-increment integers as a primary key? UUIDs let multiple services generate IDs without coordination and do not leak row counts, but they consume more space and, in the case of v4, hurt index locality. v7 closes the locality gap and is now a strong default.

What does the "4" in a716-4... mean? The first character of the third group encodes the version (1, 3, 4, 5, 6, 7 or 8). The first character of the fourth group encodes the variant — for RFC 9562 UUIDs it is always 8, 9, a or b.

Is it safe to expose UUIDs in URLs? v4 and v7 are safe to expose. Avoid v1 in public URLs because it reveals the MAC address of the generator and a fairly precise timestamp.