UUID meaning and definition
A UUID — Universally Unique Identifier — is a 128-bit number used to label something without asking anyone for permission first. Two machines with no network connection between them can each mint one, and the chance they produce the same value is small enough that production systems treat it as zero.
That is the whole point. A database sequence guarantees uniqueness by making every writer talk to one authority. A UUID trades that guarantee for independence: no coordination, no round trip, no single point of failure, and an identifier that can be created in a mobile app that has been offline for a week and still merge cleanly when it syncs.
The current specification is RFC 9562, published in 2024, which replaced the long-standing RFC 4122 and added the time-ordered versions 6, 7 and 8.
UUID format
A UUID is conventionally written as 32 hexadecimal digits in five hyphen-separated groups:
018f3c4e-7a21-7b3c-9d4e-5f6a7b8c9d0e
8 - 4 - 4 - 4 - 12
The hyphens carry no information; they are there for human eyes. Two positions in that string do carry information:
- The version is the first digit of the third group —
7b3cabove means version 7. - The variant is the first digit of the fourth group —
9d4emeans the standard variant, which prints as 8, 9, a or b.
Everything else is version-specific payload. That is why you can identify any UUID at a glance without parsing it: the 15th and 20th characters tell you what you are looking at.
The versions worth knowing
RFC 9562 defines eight, but only a few matter for new work:
- v4 — random. 122 bits from a random source. No structure, no ordering, nothing derived from the machine. The most widely used version and the one JavaScript’s
crypto.randomUUID()returns. - v7 — time-ordered. A 48-bit Unix millisecond timestamp followed by randomness. Sorts chronologically as a string or as bytes, which is what makes it well behaved as a database key.
- v5 — name-based (SHA-1). Deterministic: the same namespace and name always produce the same UUID. Useful for deriving a stable ID from something you already have, like a URL or a file path.
- v1 — timestamp and MAC address. The original time-based version. Largely superseded by v7, which sorts properly and does not embed a hardware address.
- v3, v6, v8 exist for legacy compatibility (v3 is v5 with MD5), for reordering v1 fields to sort correctly (v6), and for custom application-defined layouts (v8).
| Version | Method | Sortable | Deterministic | Use today? |
|---|---|---|---|---|
| v1 | Timestamp + MAC address | Yes (but byte order quirks) | No | Avoid — superseded by v7 |
| v3 | Name-based, MD5 | No | Yes | Avoid — use v5 instead |
| v4 | Random (CSPRNG) | No | No | Yes — default for opaque IDs |
| v5 | Name-based, SHA-1 | No | Yes | Yes — stable ID from a name or URL |
| v6 | Reordered v1 timestamp | Yes | No | Rarely — v7 is preferred |
| v7 | Timestamp + random | Yes | No | Yes — default for database keys |
| v8 | Custom layout | Depends | Depends | Only for specific application needs |
If you are choosing between the two that people actually use, the UUID v4 vs UUID v7 comparison covers the decision in detail.
Is it really unique?
Not guaranteed — probabilistic. For a random v4, uniqueness rests on 122 bits of entropy, and the relevant maths is the birthday problem rather than the raw space: collisions become likely far sooner than exhausting all 2¹²² values, but “far sooner” here still means generating on the order of a quintillion identifiers before the probability becomes worth thinking about.
Two practical caveats matter more than the arithmetic:
- The random source has to be good. A UUID generated from
Math.random()or a poorly seeded PRNG has nothing like 122 bits of real entropy, and duplicates in the wild are almost always this, not the birthday bound. Use a cryptographic source — this site uses the Web Crypto API. - Uniqueness is not unguessability. A UUID is an identifier, not a credential. Treating one as a secret means anything that logs URLs, leaks referrers, or shares a link also shares the authorisation.
What is a UUID used for?
- Database primary keys, especially where rows originate in more than one service or on the client.
- Distributed systems, where two nodes must both create records without a shared sequence.
- Idempotency keys, so a retried API call can be recognised as the same request.
- Event and trace IDs, correlating one operation across services and log streams.
- Offline-first clients, which need to create records before they can reach a server.
They are a poor fit where a short, human-communicable code is needed — order numbers read over the phone, coupon codes — and where a plain integer would do, inside a single small table that nothing else references.
Common mistakes
- Storing them as
VARCHAR(36). More than twice the bytes of the native type, in every row and every index that references it, and every comparison becomes a string comparison. - Assuming any UUID sorts by time. Only the time-ordered versions do. Sorting v4 sorts noise.
- Using them as capability tokens. See above: identifier, not secret.
- Generating them server-side out of habit. One of the main advantages is that the client can mint the ID and know it before the round trip completes.
Ready to make one? Generate a UUID v7 if it is going in a database, or generate a UUID v4 if it is going in a link.
Frequently asked questions
What does UUID stand for?
UUID stands for Universally Unique Identifier — a 128-bit number defined by RFC 9562 used to uniquely identify information across systems without requiring coordination.
What is a UUID used for?
UUIDs are used as database primary keys, distributed system identifiers, idempotency keys for API requests, event and trace IDs, and offline record creation — any situation where unique IDs must be generated without a central authority.
Is a UUID guaranteed to be unique?
Not mathematically guaranteed, but the collision probability is so small it's treated as unique in practice. You'd need to generate billions of v4 UUIDs before a collision became likely.
What's the difference between a UUID and a GUID?
None, in practice. GUID is Microsoft's name for the same 128-bit standard; the terms are interchangeable.
Are these UUIDs cryptographically secure?
The randomness is, yes — it comes from the Web Crypto API. That said, a UUID is an identifier, not a secret; don't use one as a password or an unguessable capability token on its own.
What does a UUID look like?
Thirty-two hexadecimal digits printed in five hyphen-separated groups of 8-4-4-4-12 characters, for example 018f3c4e-7a21-7b3c-9d4e-5f6a7b8c9d0e. The hyphens are formatting only; the value itself is 128 bits.
How do I tell which UUID version I have?
Read the first character of the third group. It is the version digit — 4 for a random UUID v4, 7 for a time-ordered UUID v7. The first character of the fourth group is the variant and is normally 8, 9, a or b.
Should I store a UUID as text or as binary?
As a native type where one exists — PostgreSQL's uuid and SQL Server's uniqueidentifier hold 16 bytes, while the text form costs 36 and makes every comparison a string comparison. In MySQL, BINARY(16) is the equivalent choice.