What Is a UUID? UUID v4, v1, and v7 Explained with Collision Probability

What is a UUID?

A UUID (Universally Unique Identifier), also known in Microsoft ecosystems as a GUID (Globally Unique Identifier), is a 128-bit value standardized under RFC 4122 and ISO/IEC 9834-8.

Its primary purpose is to enable distributed systems to generate unique identifiers independently, without needing a central coordinator or database auto-increment sequence.

In standard canonical string representation, a UUID is displayed as 32 hexadecimal digits grouped into five segments separated by hyphens:

xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx

An example of a valid UUID v4:

f47ac10b-58cc-4372-a567-0e02b2c3d479

Anatomy of a UUID

A canonical UUID consists of 36 characters (32 hexadecimal characters plus 4 hyphens):

8 hex digits - 4 hex digits - 4 hex digits - 4 hex digits - 12 hex digits

Two key characters identify the version and layout of the UUID:

1. The Version Digit (M):

   • Position: In the formatted 36-character string (counting from 1 and including hyphens), the version digit is at position 15 (the first character of the third group). When counting only hexadecimal digits and excluding hyphens, it is the 13th hexadecimal digit.
   • Meaning: This field identifies the UUID version. In f47ac10b-58cc-4372-a567-0e02b2c3d479, the 4 indicates UUID Version 4 (randomly generated).

2. The Variant Character (N):

   • Position: In the formatted 36-character string, the variant character is at position 20 (the first character of the fourth group). When counting only hexadecimal digits, it is the 17th hexadecimal digit.
   • Meaning: The variant field specifies the bit layout and interpretation of the UUID. For the RFC 4122 layout used here, the variant nibble has its two most significant bits set to binary 10 (10xx). This restricts the first character of this block to one of four hexadecimal values: 8, 9, a, or b (binary 1000, 1001, 1010, or 1011). In our example, a confirms a valid RFC-compatible variant.

UUID Versions compared: v1, v4, and v7

While RFC 4122 defines several versions, modern software engineering primarily revolves around three:

Why UUID v4 is the industry default

UUID v4 contains 122 bits of pure entropy. It does not reveal what server generated the ID, what time it was created, or the network hardware's MAC address. This privacy preservation makes it ideal for public session IDs, customer IDs, and API entity tokens.

What is the probability of a UUID v4 collision?

Developers frequently ask: "Could two independent machines generate the exact same UUID v4?"

Mathematically, the total number of possible UUID v4 identifiers is:

2^122 ≈ 5.3 × 10^36 possible identifiers

That is 5.3 undecillion combinations.

To put this astronomical scale into perspective:

• If you generate 1 billion UUIDs every second for the next 100 years, the cumulative probability of a single collision is approximately 1 in a billion.
• You would need to generate approximately 2.71 quintillion UUIDs (2.71 × 10^18) to reach even a 50% chance of a single collision.
• In practical terms: a catastrophic meteorite strike or a random hardware cosmic ray bit-flip is millions of times more likely than a UUID v4 collision.

How to generate UUIDs in code

JavaScript / Modern Browser & Node.js

Modern JavaScript includes native support via the Web Crypto API without external packages:

// Native browser and Node.js (v14.17+)
const id = crypto.randomUUID();
console.log(id); // e.g. "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"

Python

Python includes standard library support:

import uuid

# Generate a random UUID v4
unique_id = uuid.uuid4()
print(str(unique_id)) # e.g. "c9a646d3-9c61-4cd9-bc19-470277887f47"

Go (Golang)

Using the official Google UUID library:

package main

import (
	"fmt"
	"github.com/google/uuid"
)

func main() {
	id := uuid.New() // Generates UUID v4
	fmt.Println(id.String())
}

SQL Databases

Modern database engines generate UUIDs directly:

-- PostgreSQL (built-in in PostgreSQL 13+)
SELECT gen_random_uuid();

-- MySQL 8.0+
SELECT UUID();

-- Microsoft SQL Server
SELECT NEWID();

Database Best Practices: UUID v4 vs. Auto-Increment vs. UUID v7

When choosing a primary key strategy for your database:

1. Auto-incrementing integers (BIGSERIAL / AUTO_INCREMENT): Great for single-node performance and low index overhead, but leaks business volume (e.g., an order ID /orders/1042 reveals order velocity) and cannot be generated before inserting into distributed shards.
2. UUID v4: Superb for distributed writes, zero coordination, and secure public URLs. However, because IDs are completely random, inserting millions of rows into a B-Tree clustered index causes page splits and slower write throughput.
3. UUID v7 (The modern middle ground): Combines a Unix epoch millisecond prefix with 74 bits of randomness. IDs sort chronologically, preserving B-Tree performance while retaining distributed uniqueness.

Summary

• UUID v4 is the gold standard for secure, anonymous, and uncoordinated unique identification.
• It uses 122 bits of cryptographic entropy, rendering collisions statistically impossible in real-world applications.
• For bulk generation without writing boilerplate scripts, use our fast, browser-based UUID Generator to create batches of RFC-compliant IDs instantly.