What Is a UUID and When Should You Use One?
UUIDs appear everywhere in modern software — database primary keys, session tokens, file names, API resource identifiers. They look like random nonsense at first glance (550e8400-e29b-41d4-a716-446655440000), but they follow a precise standard designed to guarantee global uniqueness without coordination. This guide explains what UUIDs are, the five versions, and when to use each.
What Is a UUID?
A UUID (Universally Unique Identifier) is a 128-bit identifier defined by RFC 4122. It is displayed as 32 hexadecimal digits in five groups separated by hyphens: xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx. The M digit indicates the version (1–5) and the N digit indicates the variant.
Example UUID v4: 550e8400-e29b-41d4-a716-446655440000
The defining property of a UUID is that it can be generated on any machine, by any process, at any time, and the resulting identifier will (almost certainly) never collide with any other UUID ever generated.
The Five UUID Versions
| Version | How Generated | Use Case |
|---|---|---|
| v1 | Timestamp + MAC address | Time-ordered IDs, log entries |
| v2 | Timestamp + MAC + POSIX UID | Rarely used (DCE Security) |
| v3 | MD5 hash of namespace + name | Deterministic IDs from names |
| v4 | Random (122 bits) | General purpose — most common |
| v5 | SHA-1 hash of namespace + name | Deterministic IDs (better than v3) |
UUID v4: The Most Common Choice
UUID v4 generates 122 random bits (6 bits are reserved for version and variant). The result is a UUID that carries no information about when or where it was created — just randomness. This makes v4 the best choice for:
- Database primary keys in distributed systems
- Session tokens and authentication identifiers
- File names for uploaded content
- API resource IDs in REST and GraphQL APIs
- Any ID that should not reveal system information
How Unique Is UUID v4?
With 2¹²² possible values (≈ 5.3 × 10³⁶), the probability of a collision is vanishingly small. To have a 50% chance of a single collision, you would need to generate approximately 2.7 × 10¹⁸ UUIDs — that is 2.7 quintillion. At a rate of 1 billion UUIDs per second, it would take over 85 years to reach that volume. For any real-world application, UUID v4 collisions are not a concern.
UUID vs Auto-Increment: Which to Use?
| UUID v4 | Auto-Increment | |
|---|---|---|
| Size | 128 bits (36 chars) | 32 or 64 bits |
| Globally unique | Yes | Only within one database |
| Reveals record count | No | Yes (enumerable) |
| Client-side generation | Yes | No (needs DB round-trip) |
| Index performance | Lower (random ordering) | Higher (sequential) |
| Best for | Distributed systems, public APIs | Simple, single-server apps |
How to Generate a UUID
Use the ToolsBox UUID Generator to generate cryptographically random UUID v4 strings in bulk. Generate 1 to 100 UUIDs with one click, copy individually or all at once. Runs entirely in your browser using the Web Crypto API — no server, no signup.
Generate cryptographically random UUIDs — free
Generate 1–100 UUID v4 strings in one click. Uses the Web Crypto API. No signup.Frequently Asked Questions
What does UUID stand for?
UUID stands for Universally Unique Identifier — a 128-bit identifier standardised by RFC 4122, displayed as 32 hex digits in 8-4-4-4-12 format. Example: 550e8400-e29b-41d4-a716-446655440000.
How unique is a UUID v4?
UUID v4 has 2^122 ≈ 5.3×10^36 possible values. To have a 50% chance of a collision, you would need to generate 2.7 quintillion UUIDs. At 1 billion per second, that would take 85+ years. For practical purposes, collisions are impossible.
What is the difference between UUID v1 and v4?
UUID v1 uses the current timestamp and MAC address — time-ordered but reveals system information. UUID v4 uses 122 random bits — reveals nothing and is suitable for most general-purpose use cases including database keys and session tokens.
Should I use UUID or auto-increment ID?
Auto-increment IDs are smaller and have better index performance but are enumerable (reveal record count) and only unique within one database. UUID v4 is globally unique, safe to generate client-side, and reveals no system information — better for distributed systems and public-facing APIs.
← Back to Blog | Related tool: UUID Generator