What Is a UUID? Versions, Uniqueness and When to Use One
By Akmal Ali · Published · Updated · 4 min read
A UUID is a 128-bit identifier written as 32 hexadecimal digits in five groups, such as 550e8400-e29b-41d4-a716-446655440000. Version 4 UUIDs are random, so anyone can create one without coordination and the chance of a repeat is negligible. Generate them with a UUID generator or a built-in function such as crypto.randomUUID().
Most databases hand out IDs in order: 1, 2, 3. That works until two systems need to create records at the same time without asking each other, or you don’t want anyone to guess the next ID. UUIDs solve that.
What is a UUID?
A UUID (universally unique identifier) is a 128-bit number, standardised in RFC 9562. It’s written as 32 hexadecimal digits in five groups:
550e8400-e29b-41d4-a716-446655440000The groups have 8, 4, 4, 4 and 12 digits, 36 characters with the hyphens. Microsoft calls the same thing a GUID (globally unique identifier) and often writes it in capitals inside braces.
How to read a UUID
Two digits carry information about the UUID itself:
- The version is the first digit of the third group: the
4in41d4. It says how the UUID was made. - The variant is the first digit of the fourth group: the
aina716. For standard UUIDs it is 8, 9, a or b.
Everything else depends on the version.
UUID versions
| Version | Made from | Typical use |
|---|---|---|
| 1 | A timestamp and a node ID, often the network card’s address | Older systems; can reveal when and where it was made |
| 3 and 5 | A hash of a namespace and a name | The same input always gives the same UUID |
| 4 | Random numbers | The general-purpose default |
| 7 | A millisecond timestamp followed by random bits | Database keys that sort by creation time |
The VektraTool UUID generator creates version 4 UUIDs, the most widely used kind. It doesn’t make other versions.
Each UUID comes from your browser’s cryptographically secure random number generator, not from Math.random(), and you can make up to 100 at once.
UUID Generator
Create up to 100 random version 4 UUIDs at once, in lowercase, uppercase or GUID format.
Generating UUIDs in code
- JavaScript (browsers and Node.js):
crypto.randomUUID() - Python:
str(uuid.uuid4()) - PostgreSQL 13 and later:
gen_random_uuid() - macOS and Linux terminal:
uuidgen
How unique is “unique”?
A version 4 UUID has 122 random bits; the other 6 hold the version and variant. That allows about 5.3 × 1036 different values. Duplicates are possible in theory, but you would need to generate about 2.7 × 1018 UUIDs, 2.7 billion billion, before the chance of even one repeat reached 50%. With a trillion UUIDs, the chance of any duplicate is roughly 1 in 10 trillion.
That only holds when the random numbers are good. A weak generator, such as Math.random() or a badly seeded one, can repeat much sooner.
UUID or auto-increment ID?
| Auto-increment (1, 2, 3…) | UUID | |
|---|---|---|
| Size | 4 or 8 bytes | 16 bytes, or 36 characters as text |
| Created by | The database, one at a time | Anyone, anywhere, even offline |
| Guessable | Yes, the next ID is obvious | Version 4: not practically |
| Merging data from several sources | IDs clash | No clashes |
| Sort order | Creation order | Random for version 4; creation order for version 7 |
Random version 4 keys are spread across a database index, which can slow down inserts on very large tables. That is one reason version 7 exists. For most applications, either works; what matters more is storing them efficiently, in a native UUID or 16-byte binary column rather than as a 36-character string.
Common mistakes
- Using a UUID as a secret. RFC 9562 advises against treating UUIDs as hard to guess. For passwords, API keys or reset links, use a dedicated random token, such as a long one from the password generator; see how long a password should be.
- Comparing UUIDs as case-sensitive text.
550E8400-…and550e8400-…are the same UUID. Store and compare them in lowercase. - Building your own generator from timestamps or Math.random. Use the platform’s built-in function.
- Assuming UUIDs sort by time. Version 4 UUIDs don’t. Add a timestamp column, or use version 7 if your platform supports it.
Frequently Asked Questions
Can I shorten a UUID?
You can write the same 128 bits more compactly, for example as 22 characters of URL-safe Base64 instead of 36 with hyphens, as long as every system decodes it the same way. Don’t cut characters off: a truncated UUID is no longer unique.
How much space does a UUID take in a database?
16 bytes in a native UUID column, such as PostgreSQL’s uuid type, and 36 bytes or more when stored as text. Use the native type where there is one.
Can I tell when a UUID was created?
Not from a version 4 UUID, which is random apart from 6 fixed bits. Version 1 and version 7 UUIDs contain a timestamp, which is why they can reveal, or sort by, the time they were made.