UUID

Definition

A UUID (Universally Unique Identifier) is a 128-bit number used to identify information in computer systems. The defining property is independence: any machine can generate a UUID without communicating with any other machine, and the probability of two machines generating the same value is negligible.

UUIDs are defined by RFC 9562 (2024), which superseded RFC 4122.

Format

A UUID is written as 32 hexadecimal digits in five hyphen-separated groups:

550e8400-e29b-41d4-a716-446655440000
   8    -  4 -  4 -  4 -     12

Two positions carry structural meaning:

• Position 13 (first digit of the third group) — the version digit. Tells you how the UUID was generated: 4 for random, 7 for time-ordered.
• Position 17 (first digit of the fourth group) — the variant digit. For standard RFC 9562 UUIDs this is always 8, 9, a, or b.

Everything else is version-specific payload — randomness, timestamp bits, or deterministic hash output depending on the version.

Pronunciation and full form

• Full form: Universally Unique Identifier
• Pronunciation: “you-you-eye-dee” (each letter) or “oo-id” (as a word)
• Plural: UUIDs
• Microsoft equivalent: GUID (Globally Unique Identifier) — same standard, different name

Why “universally unique”?

The word “universally” is a practical claim, not a mathematical guarantee. A UUID v4 has 122 bits of randomness, giving a space of 2¹²² possible values. The probability of two independently generated v4 UUIDs colliding becomes meaningful only at approximately 2.7 × 10¹⁸ values — a number far beyond any realistic generation rate. See Collision for the mathematics.

Versions

RFC 9562 defines eight versions. The two used for new work are:

• v4 — 122 bits of cryptographic randomness. No timestamp, no structure, nothing derived from the machine. Use for externally visible identifiers.
• v7 — 48-bit Unix millisecond timestamp + randomness. Sorts chronologically. Use for database primary keys.

For a complete breakdown see UUID Versions.

Common uses

• Database primary keys — generated client-side before a round trip to the server
• Distributed system identifiers — two services can both create records without coordination
• Idempotency keys — identify a request so retries are recognised
• Event and trace IDs — correlate one operation across services and log streams
• Offline-first applications — records created before network connectivity is restored

What a UUID is not

• Not a secret or credential — a UUID in a URL is visible in logs, referrer headers, and browser history
• Not guaranteed unique — probabilistically unique, which is sufficient for all practical purposes
• Not sequential by default — only v6 and v7 are time-ordered; v4 sorts randomly

Generate one now with the UUID v7 generator or UUID v4 generator.