UUIDs (Universally Unique Identifiers) are 128-bit values used to identify things without a central authority. They’re used in databases, APIs, file systems, and distributed systems. Here’s what you need to know.
What a UUID looks like
550e8400-e29b-41d4-a716-446655440000It’s 32 hexadecimal characters separated by hyphens in a 8-4-4-4-12 pattern.
UUID versions
UUID v1 — Time-based
Generated from the current timestamp and the machine’s MAC address. Guarantees uniqueness but exposes when and where it was created. Rarely used in modern applications due to privacy concerns.
UUID v4 — Random
Generated from random numbers. The most commonly used version. With 122 random bits, the probability of a collision is astronomically low — you’d need to generate about 2.7 quintillion UUIDs to have a 50% chance of one duplicate.
UUID v7 — Time-ordered (newer)
Combines a timestamp with random data. UUIDs sort chronologically, which improves database index performance. Becoming the recommended choice for new projects.
When to use UUIDs
- Database primary keys — Especially in distributed systems where auto-increment doesn’t work across servers
- API resource identifiers — Expose UUIDs instead of sequential IDs to prevent enumeration attacks
- File naming — Guarantee unique filenames without checking for conflicts
- Session tokens — Generate unique session identifiers
- Idempotency keys — Prevent duplicate API requests
UUID vs auto-increment IDs
| Feature | UUID | Auto-increment |
|---|---|---|
| Uniqueness | Global | Per-table |
| Distributed | Yes | Requires coordination |
| Predictable | No | Yes (security risk) |
| Size | 16 bytes | 4-8 bytes |
| Index performance | Worse (random) | Better (sequential) |
| Offline generation | Yes | No |
Practical tips
- Use v4 for most cases — Simple, random, no dependencies
- Use v7 for database PKs — Better index performance due to time ordering
- Never parse UUIDs for meaning — Treat them as opaque identifiers
- Store as binary in databases — 16 bytes instead of 36 characters. Most databases have a native UUID type
- Use lowercase — The RFC allows both, but lowercase is conventional
Collision probability
The chance of generating two identical v4 UUIDs is effectively zero for any practical purpose. To put it in perspective: if you generated 1 billion UUIDs per second, it would take about 85 years to have a 50% chance of a single collision.
For bulk operations, a browser-based generator can produce hundreds of UUIDs at once, formatted and ready to copy.