What Is a UUID? Versions, Formats and Best Practices

Introduction to Universally Unique Identifiers (UUID)

A Universally Unique Identifier (UUID), also known in Microsoft ecosystems as a Globally Unique Identifier (GUID), is a 128-bit label used for identifying information in computer systems. Standardized by RFC 4122 and updated by RFC 9562, UUIDs enable distributed systems to assign identifiers without coordinating through a central authority or database lock.

How UUIDs Are Structured

In its standard text representation, a UUID consists of 32 hexadecimal digits separated into five hyphens: 8-4-4-4-12, totaling 36 characters (e.g., 550e8400-e29b-41d4-a716-446655440000).

The parts consist of:

• time_low (8 hex chars / 32 bits)
• time_mid (4 hex chars / 16 bits)
• time_hi_and_version (4 hex chars / 16 bits)
• clock_seq_hi_and_reserved + clock_seq_low (4 hex chars / 16 bits)
• node (12 hex chars / 48 bits)

Comparison of UUID Versions

What Are the Odds of a UUID v4 Collision?

Because UUID v4 has 122 random bits, the total number of possible UUIDs is 2¹²², which is roughly 5.3 × 10³⁶ (5.3 undecillion). To put this in perspective: you would need to generate approximately 1 billion UUIDs per second for 85 years before having a 50% probability of a single collision. For virtually all software architectures, UUID v4 collisions can be treated as mathematically impossible.

Database Performance Considerations

While UUIDs provide excellent isolation in distributed architectures, storing random UUID v4 values as primary keys in traditional relational databases (like PostgreSQL or MySQL InnoDB) can lead to index fragmentation. Because v4 values are uniformly random, each insertion hits a random location in the B-Tree index, causing frequent page splits and cache eviction once the index exceeds RAM.

To optimize database performance:

• Use native 128-bit binary types (such as PostgreSQL's UUID or MySQL's BINARY(16)) rather than 36-character VARCHAR strings.
• Consider time-ordered identifiers like UUID v7 or ULID for primary keys that need high insertion throughput with clustered indexing.

Frequently Asked Questions About UUIDs

Are UUIDs completely anonymous and private?

Version 4 UUIDs are completely anonymous because they are generated from pure random bits. However, legacy Version 1 UUIDs contain the physical MAC address of the network interface card that generated them, along with an exact timestamp. Using UUID v1 in public-facing identifiers can inadvertently disclose internal hardware details and creation timing to third parties.

Should I use UUIDs or auto-incrementing integers for database IDs?

Auto-incrementing serial integers (1, 2, 3...) are easy to read and provide compact 4-byte or 8-byte indexing. However, they expose business intelligence (competitors can gauge your order volume by inspecting invoice IDs: /order/1052 vs /order/1053) and suffer from enumeration attacks. UUIDs allow distributed systems and client applications to create unique IDs independently without querying a central database sequence, preventing ID-guessing attacks.

What is a ULID and how does it compare to UUID v7?

A ULID (Universally Unique Lexicographically Sortable Identifier) is a 128-bit identifier compatible with UUID storage, encoding 48 bits of timestamp followed by 80 bits of randomness, formatted as 26 Crockford Base32 characters. UUID v7 standardized this identical concept in RFC 9562, ensuring high-performance database B-tree index locality without custom libraries.

Generating UUIDs in Modern Programming Languages

JavaScript (Browser & Node.js 16+)

// Native Web Crypto API const id = crypto.randomUUID(); console.log(id); // e.g. "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"

Python 3

import uuid # Generate a cryptographically random UUID v4 id = uuid.uuid4() print(str(id))

Go (Golang)

import "github.com/google/uuid" id := uuid.New() fmt.Println(id.String())