What Is a UUID and How to Generate One

A UUID (Universally Unique Identifier) is a 128-bit label used to uniquely identify information in computer systems without requiring a central authority to coordinate assignment. If you have ever seen a string like 550e8400-e29b-41d4-a716-446655440000 in a database, API, or URL, you have seen a UUID.

UUIDs are defined in RFC 4122 and are used across virtually every modern software stack for database primary keys, session tokens, distributed system IDs, and resource identifiers.

UUID format

A UUID is 32 hexadecimal characters displayed in five groups separated by hyphens, in the form 8-4-4-4-12:

xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx

• M — the version digit (1, 3, 4, 5, or 7)
• N — the variant bits (8, 9, a, or b for standard UUIDs)

Example UUID v4:

f47ac10b-58cc-4372-a567-0e02b2c3d479

Total: 128 bits, or 16 bytes. When stored as a string it is 36 characters including hyphens, or 32 characters without.

UUID versions — which one to use?

UUID v1 — Timestamp + MAC address

v1 UUIDs embed the current timestamp and the generating machine's MAC address. They are time-sortable and unique per machine, but predictable — an attacker who knows the time and MAC address can reconstruct or predict v1 UUIDs. Do not use v1 for security tokens or user-facing IDs.

UUID v3 and v5 — Namespace-based (deterministic)

v3 and v5 generate deterministic UUIDs from a namespace + name combination using MD5 (v3) or SHA-1 (v5). The same namespace+name always produces the same UUID. Useful when you need a stable ID for a known input (e.g. a URL or domain name), but not for random unique IDs.

UUID v4 — Random (the default choice)

v4 generates 122 random bits, making it the standard choice for virtually all use cases. It requires no coordination, no registry, and no network access. The probability of two v4 UUIDs colliding is approximately 1 in 5.3 × 10³⁶ — negligible in any real-world scenario.

// Example v4 UUIDs
a7b8c9d0-1234-4abc-8def-0123456789ab
3f2504e0-4f89-11d3-9a0c-0305e82c3301

UUID v7 — Timestamp-sortable random (modern choice)

v7 is the newest widely-adopted version. It starts with a Unix millisecond timestamp, making UUIDs sortable by creation time — critical for database index efficiency. If you are using PostgreSQL, MySQL, or any B-tree index-based database and care about insert performance at scale, v7 is increasingly the preferred choice over v4.

Recommendation: use v4 for most applications. Switch to v7 if you are inserting millions of records and need index efficiency.

UUID vs GUID

GUID (Globally Unique Identifier) is simply Microsoft's name for the same concept. UUID and GUID refer to the same 128-bit identifier format defined in RFC 4122. The terms are interchangeable. Microsoft's .NET and SQL Server use GUID, while Linux, macOS, and most open-source tooling use UUID.

How to generate UUIDs in code

JavaScript (browser)

// Available in all modern browsers
const id = crypto.randomUUID();
console.log(id); // "f47ac10b-58cc-4372-a567-0e02b2c3d479"

JavaScript (Node.js 14.17+)

import { randomUUID } from 'crypto';
const id = randomUUID();
console.log(id);

Python

import uuid
id = uuid.uuid4()
print(id)  # UUID('f47ac10b-58cc-4372-a567-0e02b2c3d479')
print(str(id))  # "f47ac10b-58cc-4372-a567-0e02b2c3d479"

Go

import "github.com/google/uuid"

id := uuid.New()
fmt.Println(id.String())

Java

import java.util.UUID;

String id = UUID.randomUUID().toString();
System.out.println(id);

SQL (PostgreSQL)

-- PostgreSQL has built-in UUID generation
SELECT gen_random_uuid();

-- Or define a column with a UUID default
CREATE TABLE users (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  name TEXT NOT NULL
);

UUID use cases

• Database primary keys — Unlike auto-increment integers, UUIDs work across distributed databases without coordination.
• REST API resource IDs — GET /users/f47ac10b-58cc-4372-a567-0e02b2c3d479. Non-sequential, so users cannot enumerate resources.
• Session tokens — Generate a UUID per session and store it in a cookie or Authorization header.
• Idempotency keys — Payment APIs (Stripe, PayPal) accept an idempotency key per request. Generate a UUID client-side to safely retry failed requests.
• File names for uploads — Store uploaded files as uuid.ext to avoid collisions and obscure original names.
• Correlation IDs — Assign a UUID to each incoming request and propagate it through microservices for distributed tracing.

UUID storage considerations

Storing UUIDs as strings (VARCHAR(36)) is simple but wastes space. Prefer native UUID types where available:

• PostgreSQL — native UUID type (16 bytes)
• MySQL 8+ — store as BINARY(16) using UUID_TO_BIN() / BIN_TO_UUID()
• MongoDB — stores as Binary subtype 4 (16 bytes)
• SQLite — no native type; store as TEXT or BLOB

If index performance matters on MySQL or MariaDB, use UUID_TO_BIN(uuid, 1) (the second argument swaps the time parts to make v1 UUIDs sortable). For v4, use v7 instead if sortability is important.