What Is a UUID? Format, Versions and UUID vs GUID

A UUID (universally unique identifier) is a 128-bit number used to label data without asking a central server for the next free ID. It is usually written as 36 characters: 32 hexadecimal digits in five groups of 8-4-4-4-12, such as f47ac10b-58cc-4372-a567-0e02b2c3d479. The format is defined in RFC 9562 (May 2024), which replaced RFC 4122.

Try it free: UUID Generator - Generate Unique Universally Unique Identifiers Free to use, no account needed.

So what is a UUID good for? Any system can create one on its own, offline, and still be practically certain that nobody else will ever create the same value. That makes UUIDs popular as database keys, file names, request IDs and message IDs. This guide explains the UUID format, the versions, the real collision odds, UUID vs GUID, and how to pick between v4 and v7. To try the examples, open the free UUID Generator in another tab.

What is a UUID made of? The 8-4-4-4-12 format

The 128 bits are 16 bytes. Each byte is two hex digits, which gives 32 digits, and four hyphens bring the text form to 36 characters. Two positions carry fixed meaning:

f47ac10b-58cc-4372-a567-0e02b2c3d479
              ^    ^
              |    +-- 17th digit "a": variant (8, 9, a or b = RFC 9562)
              +------- 13th digit "4": version 4 (random)

• Version is the first digit of the third group (the 13th hex digit). It tells you how the UUID was made.
• Variant is the first digit of the fourth group (the 17th hex digit). For standard UUIDs its top two bits are 10, so this digit is always 8, 9, a or b. The values 0–7 belong to old NCS identifiers, c and d are reserved for Microsoft backward compatibility, and e and f are reserved for the future.

Because those 6 bits are fixed, a random version 4 UUID has 128 − 6 = 122 random bits. The hex letters may be uppercase, lowercase or mixed, so F47AC10B-… and f47ac10b-… are the same UUID; lowercase is the most common convention.

UUID versions: v1 to v8, nil and max

RFC 9562 defines eight versions plus two special values:

Name-based versions are deterministic. The DNS namespace with the name example.com always gives the v5 UUID cfbff0d1-9375-5685-968c-48ce8b15ae17, on every machine and in every language. Use them when the same input must always map to the same ID.

A version 7 UUID puts the time first. This example was created at 2026-09-24 12:00:00 UTC, which is 1,790,251,200,000 milliseconds after the Unix epoch, or 0x01a0d3496e00 in hex:

01a0d349-6e00-7c3f-9d21-4b6e8a1f0c57
^^^^^^^^^^^^^ ^    ^
|             |    +-- variant digit "9"
|             +------- version 7
+--------------------- 48-bit timestamp in ms

The remaining 74 bits are random (or partly a counter, depending on the library).

Are UUIDs unique? Collision odds for v4

UUIDs are not guaranteed to be unique; they are unique with overwhelming probability. With 122 random bits there are 2^122 ≈ 5.3 × 10^36 possible v4 values. The birthday approximation gives the number of UUIDs n you need for a 50% chance that at least two are equal:

n ≈ √(2 · ln 2 · 2^122) ≈ 2.71 × 10^18

That is 2.71 quintillion UUIDs. Generating one billion per second, you would reach that count after about 86 years. At more realistic volumes the risk is negligible:

These figures assume a good random number generator. In practice, collisions come from bugs: a badly seeded generator, cloned virtual machines that reuse state, or code that copies an ID instead of creating a new one. A unique constraint in the database is still worth having.

UUID vs GUID: what is the difference?

So what is a GUID? In practice, it is a UUID under another name: GUID (globally unique identifier) is Microsoft's name for the same 128-bit value, used in Windows, COM, .NET and SQL Server. .NET's Guid.NewGuid(), for example, creates an ordinary version 4 UUID. The differences are about presentation and storage:

• Text style. Microsoft tools often show GUIDs in uppercase and wrapped in braces, like {F47AC10B-58CC-4372-A567-0E02B2C3D479}. It is the same value as the lowercase form.
• Byte order in binary. Microsoft's GUID structure splits the value into a 32-bit field, two 16-bit fields and 8 single bytes. On little-endian systems, and in .NET's Guid.ToByteArray(), the first three fields are stored with their bytes reversed, while the last 8 bytes keep their order. This is often called mixed-endian:

Text form:       f47ac10b-58cc-4372-a567-0e02b2c3d479
RFC byte order:  f4 7a c1 0b | 58 cc | 43 72 | a5 67 0e 02 b2 c3 d4 79
Microsoft order: 0b c1 7a f4 | cc 58 | 72 43 | a5 67 0e 02 b2 c3 d4 79

The text is identical; only the 16 raw bytes differ. If you copy binary GUIDs between a Microsoft system and one that expects RFC order, the value comes out scrambled. Convert through the text form, or in .NET 8 and later use ToByteArray(bigEndian: true). Microsoft documents the reversed groups in its Guid.ToByteArray reference.

So "UUID vs GUID" is a naming question, not a choice you need to make.

UUID v4 vs v7 for database primary keys

Both are 128-bit UUIDs, but they behave very differently inside an index.

• v4 is random, so each new row lands at a random position in a B-tree index. Inserts touch pages all over the index, which causes page splits, more writes and a larger working set that must stay in memory.
• v7 starts with a timestamp, so new IDs are larger than older ones. Inserts go to the end of the index, much like an auto-increment integer, and rows created together sit together.

v7 also lets you sort by ID to get creation order, and you can read the creation time from the ID. That is also its drawback: anyone who sees a v7 ID learns when the record was made, to the millisecond. Use v4 for public identifiers where timing should stay private, and v7 for internal keys in large, write-heavy tables.

How to store UUIDs efficiently

Store the 16 bytes, not the 36-character text. A text column takes at least 36 bytes per value, more than twice the size, and every index that includes the key grows with it.

• PostgreSQL: use the native uuid type (16 bytes).
• SQL Server: use uniqueidentifier (16 bytes).
• MySQL: use BINARY(16) with UUID_TO_BIN() and BIN_TO_UUID() to convert.

Convert to text only at the edges of your system, such as APIs and logs.

How to generate a UUID in code

Most languages have a built-in generator:

import uuid
uuid.uuid4()                                   # random v4
uuid.uuid7()                                   # v7, Python 3.14+
uuid.uuid5(uuid.NAMESPACE_DNS, "example.com")  # cfbff0d1-9375-5685-968c-48ce8b15ae17

crypto.randomUUID(); // v4, in browsers (HTTPS pages) and Node.js

SELECT gen_random_uuid();  -- v4, built in since PostgreSQL 13
SELECT uuidv7();           -- v7, PostgreSQL 18+

Guid.NewGuid();         // v4
Guid.CreateVersion7();  // v7, .NET 9+

crypto.randomUUID() is documented on MDN.

How to validate a UUID with a regex

This pattern accepts the canonical form of versions 1–8 with the standard variant (use a case-insensitive match):

^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

The [1-8] checks the version digit and [89ab] checks the variant. Add separate checks if you also want to accept the nil and max UUIDs, braces or the urn:uuid: prefix.

UUIDs are not secrets

A UUID identifies something; it does not protect it. RFC 9562 says implementations should not assume UUIDs are hard to guess and must not use them as security capabilities. v1 exposes the creation time and, traditionally, the MAC address of the machine that made it; v7 exposes the creation time. Even a v4 from a secure generator is not meant to be a password-reset token or API key. For those, use a dedicated random token, for example from the Token Generator, and still check permissions on every request.

UUID alternatives

ULID is a popular alternative with similar goals: 128 bits, a 48-bit millisecond timestamp and 80 random bits, written as 26 Crockford Base32 characters so it sorts as text. If you need that format, the ULID Generator creates, decodes and converts ULIDs to UUIDs. For new projects, UUID v7 gives the same time ordering while keeping the standard UUID format that databases understand natively.

Generate and inspect UUIDs online

The free UUID generator runs entirely in your browser. It creates v1, v3, v4, v5 and v7 UUIDs plus the nil and max values, up to 500 at a time. You can choose lowercase, uppercase or braces, remove the hyphens, and output a list separated by lines, commas, spaces or as a JSON array, then copy it or download it as .txt or .json. For v3 and v5, pick the DNS, URL, OID or X.500 namespace or paste your own.

The built-in validator accepts canonical, braced, urn:uuid: and hyphen-less input and shows the version, variant and canonical form. It decodes the timestamp of v1 and v7 UUIDs and the clock sequence and node of v1. A few limits: it doesn't generate v6 or v8, its v1 uses a random node instead of your MAC address, and v7 IDs created in the same millisecond are not guaranteed to sort in creation order, because the bits after the timestamp are random rather than a counter.

FAQ

Is a UUID the same as a GUID?

Yes. GUID is Microsoft's name for a UUID. The value and the text format are the same; Microsoft tools often show GUIDs in uppercase with braces, and some Microsoft APIs store the first three fields in little-endian byte order in binary.

Can two UUIDs ever be the same?

In theory yes, in practice almost never. With v4 you would need about 2.71 × 10^18 UUIDs for a 50% chance of one duplicate. Real duplicates usually come from software bugs or a broken random number generator, so keep a unique constraint on key columns.

Should I use UUID v4 or v7?

Use v7 for database primary keys in tables with many inserts, because time-ordered IDs keep indexes compact and sort by creation time. Use v4 when the ID is public and should reveal nothing about when the record was created.

How long is a UUID?

A UUID is 128 bits, or 16 bytes. Its standard text form is 36 characters: 32 hex digits and 4 hyphens. Without hyphens it is 32 characters, and with braces 38.

Are UUIDs secure to use in URLs?

They are safe to show, but they are not access control. A random v4 is hard to guess, yet it can still leak through logs, browser history or referrer headers, and v1 and v7 reveal when they were created. Always check that the user is allowed to access the resource.

Try it free: UUID Generator - Generate Unique Universally Unique Identifiers Free to use, no account needed.