UUID Generator

What Is a UUID?

A UUID (Universally Unique Identifier) is a 128-bit identifier for something, such as a database record, a user session, an API request, with the idea being that it should be impossible to get a central authority to allocate the numbers. One can be created on any machine, anywhere, and the chance of two systems creating the same one by chance is insignificant.

A UUID can be represented as 5 sets of 12 hexadecimals separated by hyphens: 8-4-4-4-12:
f47ac10b-58cc-4372-a567-0e02b2c3d479

The same idea, Microsoft's name for the standard: GUID (Globally Unique Identifier). In practice, "UUID" and "GUID" are used interchangeably.

Why not a standard sequential ID?

The classic auto-increment primary key (1, 2, 3, 4...) is useful in a single database, but fails if multiple servers/services independently create records at the same time (two servers might get the same "next" number at the same time). To overcome this, UUIDs are created independently and have no need for coordination or central counter, which makes them almost certain to be unique.

In addition to the security aspect: sequential IDs provide information. If your invoice URL is /invoice/1042, then anyone can clearly deduce that there is an invoice /invoice/1041 which probably belongs to a real customer. /invoice/f47ac10b-58cc-4372-a567-0e02b2c3d479 says nothing about the number of records or whether they're valid.

UUID Versions, Explained

Some UUIDs are not created the same, the version number (first digit of the third group) gives you the clue about the way it was created.

v7 is the one that is catching on the fastest right now: it contains a timestamp, so in practice, records sort naturally in creation order which resolves a real performance issue with v4 in database indexes — random UUIDs are strewn across an index, while with v7, they are naturally sorted in order of creation, which can slow down inserts at scale.

What's the uniqueness of a v4 UUID?

A UUID is 128 bits overall, but 6 of these bits are reserved as part of the version and variant number, leaving 122 bits of actual randomness, which is 2¹²² combinations (or 5.3 undecillion, meaning a 5 followed by 36 zeros).

For comparison, if you produced on billion of UUIDs per second every second for the next 85 years, you would only have about a 50% chance of obtaining a duplicate UUID. The collision risk is assumed to be zero in essentially any real-world application.

Frequently Asked Questions