What Is a UUID? How v4 Works and When to Use It

A UUID (Universally Unique Identifier) is a 128-bit identifier designed to be unique across the world. It is widely used for database primary keys, file names, and API request IDs — anywhere you need an ID that will not collide. This guide focuses on v4, the most common variant, and explains how it works and when to use it.

The UUID format

A UUID is written as hexadecimal in five hyphen-separated groups of 8-4-4-4-12 (e.g. 123e4567-e89b-42d3-a456-556642440000). That is 32 hex digits, or 128 bits. A few of those bits are fixed to indicate the version and variant.

v4 is essentially random

A v4 UUID sets 122 bits at random (the rest indicate version and variant). With good randomness (cryptographic randomness), the chance of a collision at realistic generation volumes is negligible. Our UUID generator uses the browser’s crypto.randomUUID() to produce cryptographically secure v4 UUIDs.

Versus sequential IDs

• Sequential IDs (1, 2, 3…) are short and readable but require coordinated allocation and collide easily in distributed systems
• UUIDs can be generated independently anywhere without coordination — great for distributed or offline generation
• UUIDs are long and do not leak counts or ordering the way sequential IDs can
• On the downside, UUIDs are long and make URLs and logs harder to read

When to use it and caveats

UUIDs suit scenarios where multiple servers or clients issue IDs independently, or where you want hard-to-guess IDs. Note that v4 is random, so it has no meaningful order, which can be less efficient for database indexes than sequential IDs. A UUID is a random identifier, not a secret — do not use it in place of an authentication token.

The new standard, RFC 9562, and v7

The UUID specification was updated as RFC 9562 in May 2024, replacing the former RFC 4122. It standardizes new versions v6, v7, and v8, while existing v1, v3, v4, and v5 remain valid. The one drawing the most practical attention is v7.

v7 places a 48-bit Unix timestamp (milliseconds) at the front and fills the rest with randomness, producing a "time-ordered" UUID. Whereas v4 is fully random with no meaningful order, v7 sorts roughly in generation order, improving index efficiency when used as a database primary key. RFC 9562 recommends v7 over v1 or v6, but also notes you need not replace v4 with v7 for every use.

• v4 — fully random; hard to guess and leaks no ordering. Good for distributed or offline generation.
• v7 — sortable by time; good for database primary keys where insertion order helps. Note it embeds the creation time at the front.

To generate them, our UUID generator is handy — you can create several at once, entirely in your browser. For matching or fingerprinting data, the hash generator helps too.

Reference: RFC 9562 (Universally Unique IDentifiers (UUIDs), 2024). The statements about version specifications are based on this standard.