UUIDs and Unique Identifiers Explained
What Is a UUID?
A UUID (Universally Unique Identifier) is a 128-bit identifier designed to be globally unique across all systems and networks without requiring a central registration authority. UUIDs are also known as GUIDs (Globally Unique Identifiers), especially in Microsoft ecosystems.
A UUID is typically represented as 32 hexadecimal characters grouped into five sections separated by hyphens, following the pattern 8-4-4-4-12, for example: 550e8400-e29b-41d4-a716-446655440000. The total number of possible UUIDs is 2^128, which is approximately 3.4 × 10^38 — enough to ensure uniqueness for practical purposes.
UUID Versions
The UUID specification defines several versions, each using a different generation strategy:
| Version | Name | Generation Method | Use Case |
|---|---|---|---|
| v1 | Time-based | Timestamp + MAC address | Ordered, traceable IDs with time component |
| v3 | Name-based (MD5) | Hash of namespace + name | Deterministic IDs for named entities |
| v4 | Random | Random 128-bit value | General-purpose IDs, security-sensitive contexts |
| v5 | Name-based (SHA-1) | SHA-1 hash of namespace + name | Deterministic IDs with stronger hash than v3 |
| v7 | Time-ordered | Time-sortable + random | Database-friendly IDs with time ordering |
Why Use UUIDs?
UUIDs offer significant advantages over sequential integers or other identifier formats:
No central coordination: UUIDs can be generated independently by any system without a central ID server, making them ideal for distributed architectures.
Global uniqueness: The probability of collision is so low it is practically zero — even at massive scale.
Privacy protection: UUIDs (especially v4) do not reveal information about the entity or the order of creation, unlike sequential IDs.
Security: Sequential IDs make enumeration attacks easy (e.g., guessing user IDs). UUIDs prevent this by being unpredictable.
Database performance: While not always clustered like sequential IDs, UUIDs avoid ID reuse issues in distributed databases.
Standardization: UUIDs follow an open standard (RFC 4122) recognized across virtually all programming languages and platforms.
UUID Format Breakdown
A standard UUID looks like: 123e4567-e89b-12d3-a456-426614174000. Here is what each part represents:
8-4-4-4-12 hexadecimal format: xxxxxxxx-xxxx-Vxxx-Nxxx-xxxxxxxxxxxx
The V digit indicates the version (1, 3, 4, 5, or 7).
The N digit indicates the variant ( RFC 4122 uses the two high bits to distinguish variants).
For v1: The first 8+4+3 digits encode a timestamp with 100-nanosecond precision.
For v4: All bits (except version and variant) are randomly generated.
UUID vs. Other ID Formats
Choosing the right ID format depends on your use case:
| Feature | UUID (v4) | ULID | Snowflake ID | Sequential Integer |
|---|---|---|---|---|
| Globally unique | Yes | Yes | Yes (with coordination) | No (needs DB) |
| Sortable by time | No | Yes | Yes | Yes |
| Reveals information | No | No | Yes (timestamp) | |
| Privacy | High | High | Medium | Low |
| Database indexed | Average | Good | Excellent | Excellent |
| Standardized | Yes (RFC 4122) | No | No | No |
Frequently Asked Questions
UUID stands for "Universally Unique Identifier." It is also sometimes called a GUID (Globally Unique Identifier), particularly in Microsoft and Windows ecosystems. Both terms refer to the same concept: a 128-bit identifier designed for global uniqueness.
For all practical purposes, yes. The probability of two randomly generated UUIDs colliding is so small (approximately 1 in 2^128) that it is considered effectively zero. You would need to generate billions of UUIDs every second for trillions of years to have a meaningful chance of a collision.
UUIDs v4 and v7 cannot be guessed because they use random or time-ordered random components. However, UUIDs v1 (time-based with MAC address) can potentially be inferred if an attacker knows the approximate creation time and the generating machine's MAC address. For security-sensitive applications, use v4.
Use UUIDs when you need identifiers that can be generated without a central authority, need to be globally unique, require protection against enumeration attacks, or need to avoid exposing creation order or count information. They are ideal for distributed systems, APIs, database primary keys, and external-facing identifiers.