What Is a UUID? Versions, Uniqueness and When to Use One
What UUIDs are, how version 4 and version 7 differ, how unique they really are, and the trade-offs of using them as database keys.
A UUID, or universally unique identifier, is a 128-bit value used to label things, such as database rows, files, orders or API requests, without needing a central counter to hand out numbers. You will usually see it written as 32 hexadecimal digits in five groups, like this: 3f2b8c1e-7a4d-4b9e-9c2f-5d8e1a6b7c90. Microsoft calls the same thing a GUID.
Why not just count 1, 2, 3?
Auto-incrementing numbers work well when one database creates every record. They get awkward when records are created in many places at once: several servers, offline mobile apps, or systems that merge data later. Each would need to coordinate to avoid handing out the same number twice. A UUID can be generated anywhere, independently, with no realistic chance of a clash.
Sequential numbers also reveal information. /orders/1042 tells a competitor roughly how many orders you have had and invites people to try /orders/1043. A random UUID gives nothing away, although it is not a replacement for proper access control.
The versions you will meet
Version 4: random
A version 4 UUID is made almost entirely of random bits (122 of them). It is the most widely used version and what most UUID generators produce by default. You can spot one by the 4 at the start of the third group.
Version 7: time-ordered
Version 7, standardised in RFC 9562 in 2024, starts with a Unix timestamp in milliseconds followed by random bits. UUIDs created later sort after earlier ones, which makes them much friendlier to database indexes than fully random values, while keeping them unique and hard to guess.
Version 1 and others
Version 1 combines a timestamp with the machine's network address, which can leak information about where it was created. Versions 3 and 5 are generated from a name using a hash, so the same input always produces the same UUID.
How unique is "unique"?
With 122 random bits, a version 4 UUID has about 5.3 × 1036 possible values. You would need to generate billions of UUIDs every second for many years before the chance of even one duplicate became noticeable. For practical purposes, as long as the generator uses a good source of randomness, collisions are not something you need to design around.
Trade-offs as database keys
- Size: a UUID takes 16 bytes as binary (36 characters as text), versus 4 or 8 bytes for an integer. Store it in a native UUID or binary column rather than as text where your database allows.
- Index performance: random version 4 values scatter inserts across the index, which can slow large tables. Time-ordered version 7 values avoid most of that.
- Readability: UUIDs are hard to read out over the phone. Many systems keep a short human-friendly reference number alongside the UUID.
Generate one
The UUID v4 Generator creates random UUIDs you can copy into test data, configuration files or code. For other kinds of identifiers and fingerprints, the Hash Generator creates MD5, SHA and other hashes, and our guide to passwords and hashing explains how hashes differ from IDs.
