What is a UUID? A Simple Guide to Unique Identifiers

If you've ever worked with a database, built an API, or used a modern web app, you've probably come across UUIDs. They look like random strings of characters, but they solve a real problem. This guide explains what UUIDs are, how they work, which version to use, and the mistakes to avoid.

What is a UUID?

UUID stands for Universally Unique Identifier. It's a 128-bit number used to identify things in computer systems. The idea is simple: generate an ID that's unique across every computer, every server, and every application in the world — without needing a central authority to hand out numbers.

A UUID looks like this:

550e8400-e29b-41d4-a716-446655440000

That's 32 hexadecimal characters (0-9 and a-f), split into five groups by hyphens. The format is always 8-4-4-4-12.

You might also see the term GUID (Globally Unique Identifier). It means the same thing. Microsoft uses GUID in .NET and SQL Server. Everyone else uses UUID. The format and algorithms are identical.

Why Do UUIDs Exist?

The core problem UUIDs solve is this: how do you give every record a unique ID when multiple systems are creating records at the same time?

With auto-increment IDs (1, 2, 3...), you need a single database to hand out the next number. That works fine for a single server. But if you have multiple servers, offline devices, or systems that need to merge data later, sequential IDs break down.

Two servers might both assign ID 1. Two phones might both create a record while offline. When the data merges, you get conflicts.

UUIDs fix this. Each system generates its own IDs independently. The math behind UUID generation makes collisions so unlikely that they are treated as impossible. UUID v4 has over 5.3 x 10^36 possible values. You would need to generate 1 billion UUIDs per second for about 100 years to reach a 50% chance of a single duplicate.

UUID Versions Explained

Not all UUIDs are the same. There are several versions, each built differently.

UUID v4 — Random

This is the most common version. It's generated entirely from random numbers using a cryptographically secure source (like crypto.getRandomValues in browsers).

Use v4 when you just need a unique ID and don't care about ordering or reproducibility. It's the default choice for most applications.

UUID v7 — Time-Ordered

UUID v7 was introduced in RFC 9562 (2024). The first 48 bits are a Unix timestamp in milliseconds, followed by random bits.

The key advantage: UUIDs generated later always sort after earlier ones. This matters for database primary keys. B-tree indexes stay compact, inserts are efficient, and you avoid the page-splitting problem that random v4 values cause.

If you're designing a new database schema, v7 is the best choice for primary keys.

UUID v5 — Deterministic (Namespace + SHA-1)

UUID v5 takes a namespace and a name as input and always produces the same output. Give it the same email address twice, and you get the same UUID both times.

This is useful when you need reproducible identifiers — for example, deriving a UUID from a URL or email without storing a mapping table.

UUID v1 — Timestamp + MAC Address

The original time-based version. It embeds the current time and the device's MAC address. It's still used in some legacy systems, but it has a privacy issue: anyone who reads the UUID can extract the hardware address and creation time.

UUID v3 — Namespace + MD5

Same concept as v5, but uses MD5 instead of SHA-1. UUID v5 is preferred for new projects because SHA-1 has stronger collision resistance.

UUID v6 — Reordered Timestamp

A rearranged version of v1 that sorts chronologically. UUID v7 is simpler and generally preferred for new applications.

NIL and MAX UUIDs

NIL UUID is all zeros (00000000-0000-0000-0000-000000000000). It represents "no value" or a placeholder. MAX UUID is all fs. Both are defined in the standard but rarely used in practice.

When to Use UUIDs

UUIDs are the right choice when:

UUIDs aren't the right choice when:

FeatureUUIDAuto-Increment

UniquenessGlobalSingle database
Collision riskNear zeroNone (single source)
Human-readableNoYes
Size16 bytes (binary)4-8 bytes
PredictableNoYes
Works offlineYesNo

How to Generate UUIDs

Most languages have built-in support:

JavaScript (browser and Node.js 19+):

const id = crypto.randomUUID();

Python:

import uuid
id = uuid.uuid4()

Java:

UUID id = UUID.randomUUID();

PostgreSQL:

SELECT gen_random_uuid();

For bulk generation or other versions (v1, v5, v7), you can use our free UUID generator tool. It runs entirely in your browser, supports all versions, and lets you generate up to 1,000 UUIDs at once.

Common Mistakes

Using UUIDs as security tokens

UUIDs are identifiers, not secrets. A UUID v4 is random, but it's not encrypted. If someone gets hold of a UUID in a URL, they can access the resource. Always add proper authentication on top.

Storing UUIDs as text in the database

A UUID stored as a CHAR(36) takes 36 bytes. Stored as BINARY(16), it takes 16 bytes — less than half the space. For tables with millions of rows, this adds up in both storage and index performance. Most databases have a native UUID type. Use it.

Using UUID v4 as a primary key in large tables

Random UUIDs cause B-tree index fragmentation because new values insert at random positions. This slows down writes on large tables. UUID v7 solves this — its timestamp prefix keeps inserts sequential.

Showing UUIDs to users

UUIDs are internal identifiers. Show users a short, friendly code instead. Map f47ac10b-58cc-4372-a567-0e02b2c3d479 to Order #A7K3M in your application layer.

Not validating UUID format

Always validate UUIDs at system boundaries. A valid UUID matches this pattern:

^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Accepting any string as a UUID leads to bugs that surface later.

Best Practices

Frequently Asked Questions

Can two UUIDs ever be the same?
In theory, yes. In practice, no. The probability of a UUID v4 collision is roughly 1 in 2^122. You would need to generate billions per second for a century before a collision becomes even remotely likely.

Which version should I pick if I'm not sure?
UUID v4. It's random, widely supported, and works for the vast majority of use cases.

Is UUID the same as GUID?
Yes. GUID is Microsoft's name for the same thing. The format, size, and generation algorithms are identical.

Do UUIDs slow down databases?
Random UUID v4 values can cause index fragmentation on very large tables. UUID v7 avoids this because its timestamp prefix keeps inserts sequential. For most applications, the difference is negligible.

Can I generate UUIDs offline?
Yes. That's one of the main advantages. UUIDs don't require a central server or internet connection.

Are UUIDs good for security?
UUIDs provide uniqueness, not security. Don't use them as passwords, API secrets, or session tokens without additional authentication.

Try Our UUID Generator

We built a free online UUID generator that supports all major versions: v1, v3, v4, v5, v6, v7, NIL, and MAX. You can generate up to 1,000 UUIDs at once, copy them in multiple formats, and download as TXT, CSV, JSON, or XML. Everything runs client-side in your browser — no data gets sent to any server.

References