What is a UUID? v4 vs v7, UUID vs GUID & ULID

The UUID format

All UUIDs share the same layout, defined by RFC 9562 (which replaced RFC 4122 in 2024). The third group starts with the version digit and the fourth group encodes the variant; the rest is version-specific data.

xxxxxxxx-xxxx-Vxxx-Nxxx-xxxxxxxxxxxx
                 ^    ^
         version ─┘    └─ variant (8, 9, a or b for RFC UUIDs)

3f2504e0-4f89-41d3-9a0c-0305e82c3301   ← version 4 (random)
018f4a2c-9b3e-7d21-8c4f-1e2d3a4b5c6d   ← version 7 (time-ordered)

Try it: UUID Generator

UUID versions: v1, v4, v5 and v7

• v1 — timestamp plus the MAC address of the machine. Unique and sortable, but leaks the hardware address and the creation time; rarely used for new systems.
• v4 — 122 random bits. The most common version: no coordination, nothing leaked, trivially simple. Its only weakness is that random keys scatter inserts across a database index.
• v3 and v5 — derived by hashing a namespace and a name (MD5 for v3, SHA-1 for v5). The same input always produces the same UUID, which is useful for deterministic ids.
• v7 — a 48-bit Unix millisecond timestamp followed by random bits. Sortable by creation time, index-friendly and still unpredictable. Recommended for new database keys by RFC 9562.

Try it: UUID Generator

UUID v4 vs v7: which one should you use?

Use v7 when the UUID will be a database primary key or anything that gets indexed and queried by recency. Because v7 values increase with time, new rows land at the end of a B-tree index instead of at random positions, which keeps inserts fast and pages cache-friendly on PostgreSQL, MySQL and SQL Server. Ordering by id then also means ordering by creation time.

Use v4 when the identifier must reveal nothing at all — not even roughly when it was created — for example public tokens, unsubscribe links or anything an attacker could enumerate. For everything else, v7 is the safer default in 2026.

Try it: UUID Generator Try it: ULID Generator

UUID vs GUID vs ULID

• GUID is Microsoft's name for the same 128-bit identifier. A GUID from .NET or SQL Server is a UUID; the only differences are cosmetic (braces, upper case) and a historical byte-order quirk in some Windows APIs.
• ULID is an alternative 128-bit id that encodes a 48-bit timestamp plus 80 random bits as 26 characters in Crockford Base32 (01ARZ3NDEKTSV4RRFFQ69G5FAV). It is sortable like v7 and shorter to read and type, but it is not an RFC standard and needs a library everywhere it is used.
• Auto-increment integers are smaller and faster, but require a central sequence and expose how many records exist. Many systems use an integer internally and a UUID externally.

Try it: ULID Generator

Can two UUIDs collide?

A v4 UUID has 122 random bits, so there are about 5.3 × 10³⁶ possible values. You would need to generate roughly 2.7 × 10¹⁸ UUIDs — billions per second for a century — before the probability of a single duplicate reaches 50%. In practice collisions come from bugs (a seeded or poorly implemented random generator, copy-pasted ids), never from chance.

Generating, validating and storing UUIDs

• Generate with the platform: crypto.randomUUID() in JavaScript, uuid.uuid4() in Python, java.util.UUID in Java, gen_random_uuid() in PostgreSQL. All of them use a cryptographically secure source.
• Validate with the shape: 36 characters, hex digits, hyphens at positions 8, 13, 18 and 23, a version digit of 1–8 and a variant digit of 8, 9, a or b. Lower case is the canonical form.
• Store as a native 16-byte type (uuid in PostgreSQL, BINARY(16) in MySQL, UNIQUEIDENTIFIER in SQL Server), not as a 36-character string — it halves the index size.
• Never derive a UUID from user data unless you intend v5 determinism, and never treat a v4 UUID as a secret with the same care as a password: it is unguessable, but it is also printed in logs and URLs.

Try it: UUID Generator Try it: Random Secret Generator Try it: SQL INSERT Generator

Frequently asked questions