A UUID, or universally unique identifier, is a 128-bit value written as 32 hexadecimal digits in five groups, like 550e8400-e29b-41d4-a716-446655440000. Its purpose is simple: let different computers create IDs independently without ever needing to check with each other, and still avoid duplicates.
Why not just use numbers?
Sequential numbers, such as 1, 2, 3, work well inside one database. They break down when several servers, apps or offline devices need to create records at the same time. They also reveal information, since anyone can guess that record 1001 exists after seeing 1000. A UUID can be generated anywhere, at any time, with no central counter.
Version 4: random
Version 4 is the most common type. Apart from a few bits that mark the version and variant, all of it is random, giving 122 random bits. The chance of two randomly generated version 4 UUIDs colliding is so small that for practical purposes it can be ignored: you would need to generate billions of IDs per second for many years before a duplicate became likely.
Version 7: random but time-ordered
Version 7 was formalized in RFC 9562 in 2024. It begins with a Unix timestamp in milliseconds, followed by random bits. Because newer IDs sort after older ones, version 7 is friendlier to database indexes. Random version 4 keys are inserted all over an index, which can slow down large tables, while version 7 keys are added mostly at the end, similar to an auto-increment number.
Which version should you use?
- v4: a good default when you simply need a unique ID and ordering does not matter.
- v7: a strong choice for database primary keys and anywhere sorting by creation time is useful.
- Other versions: v1 and v6 use a timestamp and node information, and v3 and v5 create the same UUID from the same name. They are used in more specialized cases.
Practical tips
- Store them efficiently. Many databases have a native UUID type that uses 16 bytes instead of a 36-character string.
- Use lowercase consistently when comparing text versions.
- A UUID is an identifier, not a secret. Do not rely on one as a password or access token. A random version 4 is hard to guess, but real secrets should come from a secure token generator, and time-based versions leak creation time.
- Generate with a secure source. Use your language's standard library or a tool based on a cryptographic random number generator. Our UUID Generator uses the browser's secure randomness.
Validating a UUID
A valid UUID has the 8-4-4-4-12 pattern of hexadecimal digits. The first digit of the third group shows the version, so a 4 there marks a version 4. Our generator can also check pasted values and tell you what version they are. If you want to build your own checker, our guide to regex basics is a good starting point.
Frequently asked questions
Can two UUIDs ever be the same?
In theory yes, in practice almost never. With random version 4 UUIDs you would need to generate an astronomical number before a collision becomes likely.
Should I use a UUID or an auto-increment ID?
For one database that is not exposed publicly, auto-increment is simple and compact. UUIDs suit distributed systems, offline creation, merging data from several sources and public identifiers.
Are UUIDs good to use in URLs?
They work, and unlike sequential numbers they do not reveal how many records exist. They are long, though, so for short links a different ID scheme may be better.