What is a UUID?

Updated April 26, 2026 · 5 min read · by Samuel Yoo

A UUID — Universally Unique Identifier — is a 128-bit number used to identify something without coordinating with a central authority. Two systems on opposite sides of the planet can independently generate UUIDs and never collide. That’s the whole magic.

Microsoft calls them GUIDs. They’re the same thing — see UUID vs GUID.

What they look like

A UUID is almost always written as 32 hexadecimal digits in five hyphen-separated groups:

550e8400-e29b-41d4-a716-446655440000

That’s 8-4-4-4-12 hex characters, or 128 bits in total. The format is defined by RFC 4122 and updated by RFC 9562.

Why 128 bits?

The whole point of a UUID is that you can generate one without checking with a central server. To make that safe, the value needs enough bits that random generation is essentially collision-free.

128 bits gives you 2¹²⁸ ≈ 3.4 × 10³⁸ possible values. Even after generating a billion UUIDs per second for a hundred years, the chance of producing two identical ones is still vanishingly small. (See UUID collision probability for the math.)

What makes a UUID a UUID

Two specific bit ranges in the 128 bits are reserved as metadata:

• Version — 4 bits at position 48–51. Tells you how this UUID was generated (random, time-based, hash of a name, etc.). Visible as the first hex digit of the third group.
• Variant — 2 or 3 bits at position 64. Tells you which UUID specification family this value belongs to. Visible as the first hex digit of the fourth group.

In 550e8400-e29b-41d4-a716-446655440000:

• The 4 at the start of 41d4 says “version 4: random.”
• The a at the start of a716 says “variant 1: RFC 4122.”

These metadata bits are what make a UUID a UUID. They also mean only 122 of the 128 bits are actually random in a v4 UUID — the other 6 are fixed.

The versions, briefly

There are eight defined versions; you’ll encounter four in practice.

If you don’t have a specific reason, use v4 for one-off IDs and v7 for primary keys.

Why use UUIDs at all?

Compared to integer IDs (1, 2, 3, …), UUIDs trade compactness for independence:

• No coordination. Two services, two databases, two offline mobile clients — all can generate IDs that won’t clash.
• No information leak. A /users/42 URL tells someone there’s a user 41 and a user 43. A UUID URL doesn’t.
• Mergeable systems. Acquiring a company? Importing a competitor’s database? Their UUIDs slot into yours without renumbering.

The cost: 16 bytes per ID instead of 4 or 8, slightly worse cache behavior, and harder-to-read URLs. Most modern systems decide the trade-off is worth it.

When to use which form

• In URLs and JSON: the hyphenated string. Always.
• In logs: the hyphenated string. Don’t strip the hyphens — they make the value scannable.
• In databases: native UUID type if available (Postgres, MS SQL Server, MySQL 8+). Otherwise BINARY(16) for storage efficiency, with conversion at the application boundary.
• Internally between services: the hyphenated string. Skip binary unless you’re optimizing a hot path.
• As a security token: v4 is fine for unguessable URL tokens, but it’s not a substitute for a signed token (JWT) or a server-side session.

How this generator works

The generator on this site uses your browser’s native crypto.randomUUID() for v4 (a CSPRNG-backed implementation built into every modern browser) and the uuid npm package for v1, v3, v5, and v7. Generation runs entirely client-side — nothing leaves your machine.

Further reading

• UUID v7 — the modern default for database keys
• UUID vs GUID — same thing, different conventions
• UUID formats — hyphenated, braced, base64, binary
• Collision probability — the math behind “universally unique”