What is a UUID?
A UUID (Universally Unique Identifier) is a 128-bit identifier standardized by RFC 4122. UUIDs are designed to be globally unique without requiring a central authority — any system can generate one independently with a negligible chance of collision. They are formatted as 32 hexadecimal digits displayed in five groups separated by hyphens: 8-4-4-4-12.
UUIDs are used everywhere: database primary keys, distributed systems, session tokens, file names, message queues, and API idempotency keys.
UUID Versions
| Version | Based On | Sortable | Best For |
|---|---|---|---|
| v1 | Timestamp + MAC address | Partially | Legacy systems, Cassandra |
| v4 | Cryptographic randomness | No | General use, most common choice |
| v7 (draft) | Unix timestamp + random | Yes | Database PKs where sort order matters |
| ULID | Millisecond timestamp + random | Yes | Lexicographic sorting, Crockford Base32 |
When to Use UUIDs
- Database primary keys — avoid auto-increment collisions when merging databases or sharding.
- Distributed systems — generate IDs on any node without coordination.
- API idempotency keys — clients generate the ID, the server deduplicates.
- File and object naming — guaranteed unique names in S3 or file systems.
- Session and token IDs — unpredictable identifiers for security-sensitive contexts.
FAQ
Can two UUIDs ever collide?
In theory, yes. In practice, no. UUID v4 has 122 random bits, giving approximately 5.3 × 1036possible values. You would need to generate about 2.7 × 1018 UUIDs (2.7 quintillion) to have a 50% chance of a single collision. For all practical purposes, they are unique.
UUID v4 vs v7 — which should I use?
Use v4 for general-purpose identifiers where order does not matter. Use v7 (or ULID) when you need time-sortable IDs, such as database primary keys in Postgres or MySQL where index performance benefits from sequential inserts.
Is it safe to use UUIDs as security tokens?
UUID v4 uses cryptographic randomness and is safe for non-critical tokens. For high-security tokens (password resets, OAuth), prefer a dedicated secret generation library that ensures constant-time comparison and higher entropy.
Are UUIDs generated here stored anywhere?
No. Generation happens entirely in your browser using the Web Crypto API (crypto.randomUUID()). No data is sent to any server.