In this article
What Is a UUID?
A UUID (Universally Unique Identifier) is a 128-bit value used to uniquely identify information in computer systems. Written as 32 hexadecimal digits displayed in five groups separated by hyphens, a UUID looks like 550e8400-e29b-41d4-a716-446655440000.
UUIDs are designed to be globally unique without requiring a central registration authority. This makes them ideal for distributed systems where multiple nodes must independently generate identifiers that never collide.
UUID Versions Explained
The UUID standard defines several versions, each with a different generation method. The version number appears as the 13th character (the first digit of the third group).
- Version 1 (v1) — time-based: combines the current timestamp with the MAC address of the generating machine. Guarantees uniqueness but leaks hardware information
- Version 3 (v3) — name-based with MD5: generates a deterministic UUID by hashing a namespace and a name with MD5. Same input always produces the same UUID
- Version 4 (v4) — random: the most widely used version. All bits except the version and variant fields are randomly generated, providing approximately 5.3 x 10 to the power of 36 possible values
- Version 5 (v5) — name-based with SHA-1: like v3 but uses SHA-1 for hashing. Preferred over v3 for new implementations
- Version 7 (v7) — timestamp-ordered random: a newer format that combines a Unix timestamp with random bits, making UUIDs sortable by creation time
Try it free — no signup required
Validate a UUID →How UUID Validation Works
Validating a UUID involves checking both its format and structural rules. A valid UUID must match the canonical 8-4-4-4-12 hexadecimal pattern and satisfy version-specific constraints.
- Format check — the string must contain exactly 32 hexadecimal characters arranged in five groups separated by four hyphens
- Version check — the 13th character must be a valid version number (1, 2, 3, 4, 5, 6, 7, or 8)
- Variant check — the 17th character (first hex digit of the fourth group) must indicate the RFC 4122 variant (8, 9, a, or b)
Common Use Cases
UUIDs serve as the default choice for identifiers across many domains in modern software development.
- Database primary keys — UUIDs let you generate keys on the client side without round-tripping to the database, making distributed inserts seamless
- API resource identifiers — exposing UUIDs instead of sequential integers prevents enumeration attacks and hides business metrics
- Session and correlation IDs — UUIDs trace requests across microservices, making distributed debugging possible
- File and object naming — cloud storage systems use UUIDs to avoid naming collisions when multiple users upload files simultaneously
Best Practices
Choosing the right UUID version and handling them correctly can prevent subtle bugs and performance issues in your applications.
- Use v4 for general-purpose random identifiers — it is the most common choice and has no external dependencies
- Use v7 when you need time-sortable identifiers — v7 UUIDs sort chronologically, which improves database index performance
- Store UUIDs as 16-byte binary in databases rather than 36-character strings — this saves storage and speeds up comparisons
- Always validate UUIDs received from external input — never assume user-provided strings are well-formed
Frequently Asked Questions
Can two UUIDs ever be the same?
While theoretically possible, the probability of a collision with v4 UUIDs is astronomically low. You would need to generate about 2.7 quintillion UUIDs to have a 50 percent chance of a single collision.
Is a UUID case-sensitive?
No. The RFC 4122 standard specifies that UUIDs should be output as lowercase, but implementations must accept both uppercase and lowercase hexadecimal characters as equivalent.
Should I use UUID or ULID?
ULIDs are 128-bit identifiers that are lexicographically sortable and Crockford Base32 encoded. If you need sortability without the complexity of UUID v7, ULIDs are a good alternative. If compatibility with existing systems matters, stick with UUIDs.