What Is a UUID? A Complete Explanation of Universally Unique Identifiers
Quick Answer
A UUID is a 128-bit identifier represented as 36 characters (32 hex digits plus 4 hyphens). UUIDs are practically unique without coordination — the collision probability is negligible. UUID v4 (random) is the most common version. Use our free UUID Generator to create UUIDs in your browser.
Introduction
A UUID (Universally Unique Identifier), also called a GUID (Globally Unique Identifier) in Microsoft terminology, is a 128-bit identifier that is practically guaranteed to be unique without central coordination. UUIDs are defined by RFC 4122 and are widely used as database primary keys, request IDs, session tokens, and distributed system identifiers. The most common version is UUID v4, which uses random bits. A UUID is represented as 32 hex digits in 5 groups separated by hyphens: 8-4-4-4-12 (e.g., 550e8400-e29b-41d4-a716-446655440000).
Step by Step
-
Understand UUID structure
A UUID is 128 bits, displayed as 32 hexadecimal digits in 5 groups: 8-4-4-4-12, separated by hyphens (e.g., 550e8400-e29b-41d4-a716-446655440000). The 13th digit indicates the version (4 for v4), and the 17th digit indicates the variant.
-
Learn the UUID versions
v1: time-based (timestamp + MAC address) — time-ordered but leaks identity. v3: name-based with MD5 hashing. v4: random — most common, no privacy concerns. v5: name-based with SHA-1 hashing. v6 and v7: time-ordered with improved privacy over v1.
-
Understand collision probability
UUID v4 has 2^122 possible values. The probability of a collision among 103 trillion UUIDs is 50%. For practical use (millions of IDs), the collision probability is effectively zero — you can generate UUIDs independently without coordination.
-
Use UUIDs appropriately
Use v4 for almost all use cases (database IDs, request IDs, session tokens). Use v7 if you need time-ordered IDs for database locality. Avoid v1 in security-sensitive contexts — it embeds a timestamp and MAC address.
Examples
UUID v4 (random)
Input: Generated with crypto.getRandomValues
Output: 550e8400-e29b-41d4-a716-446655440000
UUID v1 (time-based)
Input: Timestamp + MAC address
Output: a3bbf0ee-d6e4-11ed-a5b3-3c9703e8b4a1
Nil UUID
Input: All zeros
Output: 00000000-0000-0000-0000-000000000000
Common Problems
- Using Math.random() for UUIDs —it is not cryptographically secure. Use crypto.getRandomValues() or crypto.randomUUID() in browsers.
- Storing UUIDs as strings —a UUID string is 36 bytes; stored as a UUID type (16 bytes) it is more efficient. Use the native UUID type in databases when available.
- Using v1 in security-sensitive contexts —v1 embeds a timestamp and MAC address, which can leak information about when and where it was generated. Use v4 for anonymity.
- Assuming UUIDs are truly unique —they are practically unique (collision probability is negligible), but not mathematically guaranteed unique.
Tips
- Use UUID v4 for almost all use cases —it is random, has no privacy concerns, and is supported by all modern databases.
- Use crypto.randomUUID() in modern browsers for a built-in v4 generator without a library.
- Store UUIDs as UUID/GUID type in databases (16 bytes) instead of strings (36 bytes) for better storage and index performance.
- Use our UUID Generator to create UUIDs instantly in your browser —no signup, fully private.