Guides Development

How UUIDs Work

The structure of a UUID (version and variant bits), what each version means, why random UUIDs almost never collide (with the birthday-paradox numbers) and how to generate and decode them.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

A UUID (universally unique identifier, also called GUID) is a 128-bit label written as 32 hex digits in the pattern 8-4-4-4-12. Anyone can generate one without a central registry. The format is defined by RFC 9562. Create them with the UUID Generator, read them with the UUID & ULID Decoder, and choose between the popular kinds in UUID v4 vs UUID v7 vs ULID. The glossary entry is UUID.

Reading a UUID

  • Example: f47ac10b-58cc-4372-a567-0e02b2c3d479.
  • The version is the first hex digit of the third group (4 here: random).
  • The variant is in the first digit of the fourth group: 8, 9, a or b means the standard layout (here a).
  • Two special values exist: the nil UUID 00000000-0000-0000-0000-000000000000 and the max UUID ffffffff-ffff-ffff-ffff-ffffffffffff.

The versions

Version What it contains Notes
1 Timestamp (100 ns ticks since 1582-10-15) + node ID Legacy; the node ID can leak a MAC address
3 MD5 hash of a namespace and a name Same input, same UUID; avoid for new work
4 122 random bits The default; reveals nothing
5 SHA-1 hash of a namespace and a name Same input, same UUID; stable IDs for names
6 v1 with the timestamp reordered so it sorts Compatibility with v1
7 48-bit Unix time in ms + random Sorts by creation time; good for database keys
8 Custom: vendor-defined layout Experimental or private use

How unlikely is a collision?

A version-4 UUID carries 122 random bits, about 5.3 × 10^36 values. By the birthday paradox, you would need roughly 2.7 × 10^18 UUIDs for a 50 % chance of a single duplicate: generating a billion a second, that takes about 86 years.

Practical advice

  • Name-based UUIDs are reproducible: the version-5 UUID of example.com in the DNS namespace is always cfbff0d1-9375-5685-968c-48ce8b15ae17.
  • A UUID is an identifier, not a secret. Do not use one as a password-reset token or API key unless it comes from a secure random source, and prefer longer tokens for secrets.
  • Store UUIDs as 16 bytes (a native uuid column), not as 36-character text, when you can.
  • Use time-ordered v7 for new database primary keys to avoid scattering inserts across the index.

Try these tools

UUID Generator

Generate cryptographically random RFC 4122 v4 UUIDs online, one at a time or in bulk.

UUID & ULID Decoder

Decode UUIDs (versions 1 to 8) and ULIDs online.

See also

  • Glossary UUID
    A UUID (universally unique identifier) is a 128-bit value, written as 36 characters.
  • Comparison UUID v4 vs UUID v7 vs ULID
    Random UUIDs, time-ordered UUIDs and ULIDs compared: bit layout, text length, sorting, database index behaviour and when to use each.
  • Glossary Unix timestamp
    A Unix timestamp is the number of seconds since 00:00:00 UTC on 1 January 1970, the "Unix epoch".
  • Glossary Hash
    A hash is the fixed-length fingerprint a hash function computes from any input.
  • Guide How Hashing Works
    What a hash function does, the avalanche effect shown with real SHA-256 output, which algorithms are still safe, HMAC.
  • Guide How Randomness and Fair Draws Work
    Pseudo-random versus secure randomness, modulo bias, why naive shuffles are biased, streaks, exact lottery.

Frequently Asked Questions

Yes in theory, but a version-4 UUID has 122 random bits, so a 50 % chance of even one collision needs about 2.7 × 10^18 UUIDs. In practice a bad random number generator is a bigger risk than chance.

Back to the guides
AdSense Placeholder
Slot: footer_leaderboard