What is a UUID (Universally Unique Identifier) & GUID?
A Universally Unique Identifier (UUID) is a 128-bit label used for information in computer systems, formally standardized by the Internet Engineering Task Force (IETF) in RFC 4122 and ITU-T Recommendation X.667. In Microsoft systems and .NET architecture, the exact same 128-bit structure is traditionally termed a Globally Unique Identifier (GUID).
When formatted as a canonical string, a UUID consists of 32 hexadecimal digits displayed in 5 distinct groups separated by hyphens:
xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx (8-4-4-4-12 format)
Where M represents the UUID version (1 through 7) and N denotes the variant bits (e.g. 8, 9, a, or b for RFC 4122).
Comparison of UUID Versions (v1 vs v3 vs v4 vs v5 vs v7)
| Version | Generation Source | Deterministic? | Primary Use Case & Characteristics |
|---|---|---|---|
| UUID v1 | Time + MAC Address | No | Time-based. Exposes network card MAC address and creation timestamp (privacy concerns). |
| UUID v3 | Namespace + MD5 Hash | Yes | Deterministic name hashing using MD5. (Deprecated in favor of v5 due to MD5 collisions). |
| UUID v4 | Cryptographic Randomness (CSPRNG) | No | Most Popular Worldwide. 122 bits of pure entropy. Zero privacy leaks, completely random. |
| UUID v5 | Namespace + SHA-1 Hash | Yes | Deterministic name hashing using SHA-1. Same inputs always yield the identical UUID. |
| UUID v7 | Unix Timestamp (ms) + Random | No | New IETF Standard. Monotonically sortable by time. Optimizes database B-Tree index locality. |
The Mathematics of UUID v4 Collision Probabilities
A common question from software engineers is: "Can two independently generated UUID v4 tokens ever collide?"
Because a Version 4 UUID reserves 6 fixed bits for version and variant metadata, the remaining 122 bits are generated using cryptographically strong pseudo-random numbers (CSPRNG). The total number of distinct UUID v4 values is:
2^122 ≈ 5,316,911,983,139,663,491,615,158,247,025,845,248 (5.3 × 10^36)
By applying the Birthday Paradox mathematical formula, the probability of generating a single collision after creating 1 billion UUIDs is approximately 1 in 103 trillion. Even if a system produced 1 billion UUIDs per second non-stop for 100 consecutive years, the probability of encountering a single duplicate remains infinitesimally close to zero.
UUIDs vs Auto-Incrementing Integers as Database Primary Keys
Advantages of UUIDs
- Distributed Key Generation: Clients and microservices can generate unique IDs offline without round-tripping to a central database sequence.
- Security & ID Enumeration Prevention: Sequential integer IDs (like
/user/101) allow attackers to scrape data or estimate business volume. UUIDs prevent enumeration. - Easy Database Merging: Merging records from multiple database shards or staging environments never causes ID key collisions.
Trade-offs & Considerations
- Storage Footprint: 128-bit UUIDs consume 16 bytes in binary form (or 36 bytes as strings) vs 4 to 8 bytes for standard
INT/BIGINTkeys. - B-Tree Index Fragmentation: Because random UUID v4 inserts are unordered, relational database indexes (PostgreSQL, MySQL InnoDB) suffer page splits. Using time-ordered UUID v7 mitigates this.
Frequently Asked Questions (FAQ)
How does this tool generate secure random UUIDs?
This tool utilizes the modern Web Cryptography API's crypto.randomUUID() method natively built into your browser. It uses cryptographically secure hardware entropy sources rather than predictable Math.random() pseudorandom seeds.
What is a Nil UUID?
A Nil UUID is a special-case UUID where all 128 bits are set to zero: 00000000-0000-0000-0000-000000000000. It is commonly used in software to represent an uninitialized or null identifier.