What Is a UUID? A Plain-English Guide for Developers
If you've worked with databases, REST APIs, or file systems, you've encountered strings like 550e8400-e29b-41d4-a716-446655440000. This is a UUID — a Universally Unique Identifier — and its unusual format (five groups of hexadecimal characters separated by hyphens) is deliberate. Understanding what UUIDs are, how their versions differ, and when to use them makes you a more effective developer.
The UUID Format
Every UUID is 128 bits of data, represented as 32 hexadecimal characters arranged in the pattern 8-4-4-4-12 (the numbers represent how many hex characters are in each group, separated by hyphens). The full string is always 36 characters including hyphens.
The third group's first character indicates the version (the algorithm used to generate it), and the fourth group's first character encodes the variant (which UUID specification it conforms to). In a version 4 UUID, you'll always see a “4” at that position, and the first character of the fourth group will be 8, 9, a, or b.
UUID Versions: Which One Should You Use?
Version 1 (timestamp-based) — generated from the current time and the MAC address of the generating machine. The timestamp portion means v1 UUIDs are roughly sortable by generation time. The downside: the MAC address embeds hardware information, which is a minor privacy concern. Rarely used in new systems.
Version 4 (random) — generated from 122 bits of random data (plus 6 version/variant bits). This is the most common UUID version by far. There is no timestamp, no machine information, and no coordination required between generators. The probability of a collision — two independently generated v4 UUIDs being identical — is so astronomically small that it's practically impossible at any scale a single system will ever reach.
Version 5 (namespace + SHA-1) — deterministic. Given the same namespace UUID and the same input string, a v5 UUID will always produce the same output. Useful for generating stable IDs from known inputs (e.g., always the same UUID for a given URL or email address).
Version 7 (time-ordered random) — a newer standard that embeds a millisecond-precision Unix timestamp in the first 48 bits, followed by random data. V7 UUIDs are lexicographically sortable by creation time, which makes them database-friendly: they produce sequential index values rather than random inserts scattered across the B-tree.
UUID vs ULID vs CUID
ULID (Universally Unique Lexicographically Sortable Identifier) encodes a timestamp and random component in a 26-character Base32 string. Like UUID v7, it's sortable by generation time. Shorter and URL-safe by default.
CUID / CUID2 are designed to be collision-resistant identifiers safe for use in distributed systems and as database primary keys. They're shorter than UUIDs, URL-safe, and designed to be harder to guess.
For most applications, UUID v4 is fine. If your database performance is suffering from random primary key inserts fragmenting the index, consider UUID v7 or ULID.
When to Use UUIDs
UUIDs shine in distributed systems where multiple nodes generate IDs independently without coordination. An auto-incrementing integer requires a central authority (the database) to issue each ID in order. A UUID can be generated on the client, in a microservice, or in a browser without any round-trip to a server.
They're also valuable as public-facing identifiers. An auto-increment ID of 42 tells an attacker that there are at least 42 records — and they can enumerate nearby IDs. A UUID exposes nothing about your data volume or structure.
Generate UUIDs instantly with our UUID Generator — bulk generation, version selection, and one-click copy, entirely in your browser. For UUID validation, parsing, and version detection, the UUID Tools page has you covered.