What is UUID?
UUID (Universally Unique Identifier) is a 128-bit identifier format standardized by RFC 9562. The canonical text form uses 32 hexadecimal digits in five hyphen-separated groups (8-4-4-4-12); uniqueness depends on the selected version and a correct generator, not a universal guarantee.
Quick Facts
| Full Name | Universally Unique Identifier |
|---|---|
| Created | Originated in the 1980s; current standard RFC 9562 published in 2024 |
| Specification | Official Specification |
How It Works
UUID means Universally Unique Identifier and is often called GUID in Microsoft ecosystems. RFC 9562, published in 2024, obsoletes RFC 4122 and defines versions with different semantics. UUID v4 uses 122 random bits. UUID v5 deterministically hashes a namespace and name with SHA-1 for identifier compatibility, not for security. UUID v7 places a 48-bit Unix millisecond timestamp first and allocates the remaining version-specific fields to random data and optional monotonic generation methods. RFC 9562 recommends v7 over v1 or v6 when possible; it does not make v7 mandatory over v4 for every workload. V7 can improve index locality, but strict ordering and performance depend on clock behavior, generator state, concurrency, database, and storage format. Applications should enforce uniqueness and keep authorization separate from identifiers.
Key Characteristics
- 128-bit layout containing version and variant fields plus version-specific data
- Canonical text format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
- Version-specific semantics for random, name-based, and time-based generation
- Can be generated without a central allocator when the chosen algorithm is implemented correctly
- Collision risk is probabilistic and must be backed by a database unique constraint where uniqueness matters
- Hexadecimal text is case-insensitive, although the RFC canonical form uses lowercase
Common Use Cases
- Database primary keys in distributed systems
- Non-secret resource and correlation identifiers in web applications
- File and resource naming
- Transaction IDs in microservices
- Device identification
Example
Loading code...Frequently Asked Questions
What is the difference between UUID and GUID?
GUID is Microsoft's common name for a 128-bit identifier, while UUID is the RFC term. Their string forms often interoperate, but byte ordering and serialization conventions can differ in some APIs. Check the concrete platform contract instead of assuming every binary representation is interchangeable.
Which UUID version should I use?
Use v4 when random identifiers and no embedded creation time fit the requirement. Evaluate v7 when approximate time ordering and index locality matter, while accounting for timestamp disclosure and clock behavior. Use v5 only for deterministic namespace-and-name identifiers. RFC 9562 recommends v7 over v1 or v6 when possible, not over every use of v4.
Can UUID collisions actually happen?
Yes. With a correct cryptographic generator, v4 has a 122-bit random space and collisions are extremely unlikely at ordinary scale, but not impossible. Use the birthday bound for capacity analysis, enforce a unique constraint, and retry or fail safely on conflict. A broken or duplicated random generator can dominate the theoretical probability.
How do I generate a UUID in different programming languages?
For v4, use maintained platform APIs such as crypto.randomUUID() in JavaScript, uuid.uuid4() in Python, UUID.randomUUID() in Java, Guid.NewGuid() in .NET, or a maintained Go UUID package. For v7, verify the exact runtime or library version and its monotonicity behavior. Do not use PHP uniqid(), timestamps alone, or Math.random() as UUID substitutes.
Should I use UUID or auto-increment ID for database primary keys?
Choose from coordination, merge, storage, index, privacy, and exposure requirements. Native 16-byte UUID storage avoids text overhead. V7 may improve locality compared with random v4, but benchmark under real concurrency and clock behavior. Auto-increment keys are compact and ordered but need allocation coordination. Neither identifier type provides authorization or should be treated as a secret.