Universally Unique Identifier (UUID / GUID)

A Universally Unique Identifier (UUID)—also referred to as a Globally Unique Identifier (GUID) within Microsoft ecosystems—is a standardized 128-bit (16-byte) label governed by IETF RFC 9562 (superseding RFC 4122). UUIDs enable distributed computing systems to generate globally collision-resistant identifiers autonomously without consulting a central coordinating registry, server, or relational database sequencer.

Generate, format, and inspect cryptographically secure v4 and time-ordered v7 identifiers in bulk with our UUID Generator tool.

---

Canonical Format & Structural Anatomy

A canonical UUID is rendered as a 36-character hexadecimal string broken into five hyphen-separated segments following the 8-4-4-4-12 format:

                  time_low     time_mid  ver  time_hi  var  clock_seq  node (MAC or Random)
Canonical UUID:   f47ac10b   -   58cc   - 4    e0e   - 8     e78   -   4817a874b369
                  (8 chars)    (4 chars) (4 chars)   (4 chars)        (12 chars)

Within the 128-bit payload, two fields explicitly dictate the identifier's internal architecture:

1. Version Nibble (Position 13): Indicates the generation algorithm (e.g., 4 for random, 7 for time-ordered).
2. Variant Bits (Position 17): Encodes compliance with RFC standards (typically starts with hexadecimal 8, 9, a, or b, representing binary 10xx).

---

UUID Versions: The Comprehensive Matrix

Version	Core Mechanism	Predictable?	Privacy Risk	Primary Best Use Case
v1	60-bit timestamp + MAC address	Yes	High (Leaks hardware MAC & time)	Legacy systems only; avoid for new architectures.
v3	MD5 hash of a namespace + name	Deterministic	Low	Reproducible deterministic IDs from names (legacy).
v4	122 cryptographically random bits	No	Zero	Ephemeral tokens, session keys, distributed entities.
v5	SHA-1 hash of a namespace + name	Deterministic	Low	Reproducible deterministic IDs (RFC 9562 standard).
v6	Reordered v1 for B-tree sortability	Yes	High (Retains MAC address)	Transitionary format superseded by v7.
v7	48-bit Unix epoch ms + random bits	Monotonic	Zero	Modern Gold Standard for Database Primary Keys.
v8	Custom vendor-defined bit layouts	Varies	Varies	Experimental and proprietary enterprise protocols.

---

UUID v4 vs UUID v7: The Database B-Tree Index Dilemma

For decades, UUID v4 has been the default identifier in web frameworks. However, storing UUID v4 as a primary key in high-throughput relational databases (PostgreSQL, MySQL InnoDB, SQL Server) triggers catastrophic performance degradation:

The Problem with UUID v4 in Databases

Relational databases index primary keys using B-Trees. Because UUID v4 is completely random, new records are inserted at unpredictable random locations throughout the index:

• Random Page Splits: Database engine pages in memory must constantly flush and rewrite storage blocks.
• Cache Thrashing: The database cannot keep hot index pages in RAM cache, causing high disk I/O.
• Table Bloat: Indexes consume up to 40–50% more disk space due to half-filled, fragmented B-tree nodes.

UUID v4 Insertion (Random Chaos):
Insert A (Page 1) ──► Insert B (Page 94) ──► Insert C (Page 12) ──► Insert D (Page 73)
Result: Massive B-Tree fragmentation, high disk I/O, slow writes.

UUID v7 Insertion (Chronological Order):
Insert A (Page 1) ──► Insert B (Page 1) ──► Insert C (Page 1) ──► Insert D (Page 2)
Result: Sequential appends, maximum caching efficiency, zero index bloat.

The Solution: UUID v7 (RFC 9562)

Published in 2024, UUID v7 combines a 48-bit millisecond Unix timestamp with 74 bits of cryptographically random data. This guarantees that newly created IDs are naturally sorted in chronological order while maintaining total privacy and uniqueness without leaking hardware addresses.

---

Collision Probability: Can UUID v4 Ever Collide?

UUID v4 reserves 6 bits for version and variant metadata, leaving 122 bits of true entropy ($2^{122} \approx 5.3 \times 10^{36}$ unique values).

Based on the Birthday Paradox:

• To achieve a one in a billion (1 in $10^9$) chance of collision, you would need to generate 103 trillion UUIDs.
• If a system generated 1 billion UUIDs every second, it would take 100 years to reach that 1 in a billion probability.
• In distributed environments, UUID v4 collisions are considered a mathematical impossibility for practical software engineering.

---

Code Examples: Generating UUIDs

Native JavaScript (Modern Browsers & Node.js 16+)

// Generate cryptographically secure UUID v4 natively
const uuidV4 = crypto.randomUUID();
console.log("UUID v4:", uuidV4);
// Example output: "c9a646d3-9c61-4cd9-bf12-7258163da9d4"

// Basic RFC 9562 UUID v7 generator in JavaScript
export function generateUuidV7(): string {
  const timestamp = BigInt(Date.now());
  const randBytes = crypto.getRandomValues(new Uint8Array(10));

  // 48-bit timestamp in big-endian
  const timeHex = timestamp.toString(16).padStart(12, '0');

  // Format with version 7 (0x7) and variant (0x80)
  const part3 = `7${Array.from(randBytes.slice(0, 2)).map(b => b.toString(16).padStart(2, '0')).join('').slice(1)}`;
  const varByte = (randBytes[2] & 0x3f) | 0x80;
  const part4 = `${varByte.toString(16).padStart(2, '0')}${randBytes[3].toString(16).padStart(2, '0')}`;
  const part5 = Array.from(randBytes.slice(4, 10)).map(b => b.toString(16).padStart(2, '0')).join('');

  return `${timeHex.slice(0, 8)}-${timeHex.slice(8, 12)}-${part3}-${part4}-${part5}`;
}

Python 3

import uuid

# Generate UUID v4
id_v4 = uuid.uuid4()
print("UUID v4:", str(id_v4))

# Check version and variant
print("Version:", id_v4.version)  # 4
print("Variant:", id_v4.variant)  # specified in RFC 4122

---

Frequently Asked Questions

What is the difference between a UUID and a GUID?

Technically, they are identical: both are 128-bit identifiers compliant with RFC standards. GUID (Globally Unique Identifier) is Microsoft's historical nomenclature, while UUID (Universally Unique Identifier) is the international standard defined by ISO and the IETF.

Why should new projects choose UUID v7 over UUID v4?

For distributed database primary keys, UUID v7 is vastly superior. Its chronological millisecond timestamp allows database storage engines to perform sequential B-tree writes, eliminating the disk page fragmentation, cache misses, and query slowdowns inherent to UUID v4.

Why is UUID v1 considered a privacy hazard?

UUID v1 derives its trailing 48 bits from the physical network card's IEEE 802 MAC address and its leading bits from the system clock. Anyone inspecting a v1 UUID can identify the specific physical computer that created it and the exact microsecond of its creation.

How much storage does a UUID occupy in a database?

A UUID occupies 16 bytes when stored in a native binary format (UUID type in PostgreSQL, BINARY(16) in MySQL). If stored as a plain hyphenated string (VARCHAR(36)), it consumes 36 bytes plus length byte overhead—more than double the binary footprint.