About UUIDs

What is a UUID?

UUID (Universally Unique Identifier) is a 128-bit value used to uniquely identify objects. Version 4 UUIDs use cryptographically random bits.

Format

Standard format: 8-4-4-4-12 hex digits separated by hyphens. Example: 550e8400-e29b-41d4-a716-446655440000

Use cases

Database primary keys, session IDs, file names, API request tracking, distributed system identifiers.

How to Use the UUID Generator

Select UUID version — Version 4 (random) is the most common for general use. Version 1 (time-based) encodes the generation timestamp and MAC address.
Set quantity — generate 1 to 100 UUIDs at once for batch operations.
Choose format — standard format with hyphens (550e8400-e29b-41d4-a716-446655440000), without hyphens, or uppercase.
Copy single or all — copy individual UUIDs or all generated UUIDs at once for use in databases, code, or configuration.
Regenerate — click again for completely new UUIDs — all generated values are cryptographically random and unique.

🎲 UUID collision probability: With version 4 UUIDs, generating 1 billion UUIDs per second for 100 years, the probability of a single collision is approximately 50%. In practice, even generating millions of UUIDs in an application, collision is for all practical purposes impossible — there are 2^122 possible v4 UUID values.

Understanding UUIDs

🔑 What Is a UUID?

Universally Unique Identifier — a 128-bit label used to uniquely identify information without requiring central coordination. Formatted as 32 hexadecimal digits in 5 groups: 8-4-4-4-12 (e.g. 550e8400-e29b-41d4-a716-446655440000). Standardised in RFC 4122. Also called GUID (Globally Unique Identifier) in Microsoft environments.

🎲 Version 4 (Random)

122 bits of cryptographic randomness with 6 bits indicating version and variant. The most commonly used version. No information about when or where it was created is embedded. Suitable for database primary keys, session IDs, file names, and any use case requiring unique identifiers without coordination.

⏰ Version 1 (Time-based)

Combines current timestamp (60-bit, 100-nanosecond precision) with the generating machine's MAC address. Guaranteed unique across time and space. Drawback: encodes the MAC address (privacy concern) and timestamps are monotonically increasing (predictable). Rarely used in modern applications.

🆔 Version 5 (Name-based)

Deterministic UUID generated from a namespace UUID and a name using SHA-1 hashing. The same namespace+name always produces the same UUID. Useful for generating consistent IDs for known entities (e.g. always the same UUID for 'toolsnova.net' in the 'URL' namespace). Not random — it is a hash.

🗄️ UUID as Primary Key

Using UUIDs as database primary keys instead of auto-increment integers: Advantages — globally unique (safe to generate client-side or across multiple databases), no information leakage (integer IDs reveal record count), easy database merging. Disadvantages — larger storage (16 bytes vs 4–8 bytes), index fragmentation with random v4 UUIDs, less human-readable in logs.

⚡ ULID Alternative

Universally Unique Lexicographically Sortable Identifier — a newer alternative to UUID. 128 bits like UUID, but 48 bits are a millisecond timestamp making ULIDs chronologically sortable. This solves the UUID database index fragmentation problem while maintaining uniqueness. Increasingly popular for new applications.

UUIDs in Application Development

UUID primary key strategy

For new applications, UUID v4 primary keys are strongly recommended over auto-increment integers. The key benefits: IDs can be generated client-side before database insertion (eliminating round-trips), IDs are safe to expose in URLs (integers reveal total record count to users), and multiple database shards or merged databases never have ID conflicts. The performance difference is negligible in most applications — only at very high scale (billions of rows) do UUID index fragmentation issues warrant special handling.

UUID v7 — the future standard

UUID version 7 (RFC 9562, finalised 2024) combines a Unix timestamp prefix with random bits, making UUIDs chronologically sortable while remaining globally unique. This solves the primary database performance concern with v4 UUIDs (random order causes B-tree index fragmentation) while maintaining the uniqueness and client-side generation benefits. UUID v7 is increasingly supported in modern databases and languages and should be the first choice for new projects.

Session and token generation

UUIDs are commonly used for session IDs, API tokens, and password reset tokens. For these security-sensitive uses, cryptographic randomness is essential — UUID v4 uses cryptographically secure random number generation (CSPRNG) making it suitable. Avoid UUID v1 for tokens as the timestamp and MAC address encoding makes tokens somewhat predictable. For API keys and passwords reset tokens specifically, consider using 32+ bytes of CSPRNG output encoded as hex or base64 rather than UUID format.

🔑 UUID quick reference: General unique ID: UUID v4. Time-sortable ID (new projects): UUID v7. Deterministic ID from known input: UUID v5. Microsoft environments: GUID (same as UUID). JavaScript: crypto.randomUUID() (built-in, v4). Python: uuid.uuid4() (built-in). PostgreSQL: gen_random_uuid() (built-in). These native implementations are always preferred over custom ID generation.

Frequently Asked Questions

What is UUID v4?

UUID v4 uses cryptographically random bits for all significant parts. It offers 2^122 possible values — statistically impossible to duplicate even generating millions per second for millions of years.

UUID vs GUID?

Functionally identical. GUID (Globally Unique Identifier) is Microsoft's term for UUID. Both follow RFC 4122. The terms are interchangeable.

When should I use UUIDs?

As database primary keys (avoiding sequential ID guessing), distributed system identifiers, session tokens, file names to prevent collisions, and any situation needing a unique ID without a central authority.