A UUID is a 128 bit number used to label things so that no two labels are ever the same. The letters stand for Universally Unique Identifier. You have almost certainly seen one. They look like this:
550e8400-e29b-41d4-a716-446655440000That string is 36 characters long: 32 hexadecimal digits split into five groups by four hyphens. The groups have 8, 4, 4, 4 and 12 digits. Every UUID in the world, no matter who made it, follows this same shape.
Why do we need them?
Most programs need to give things an identity. A user, an order, an uploaded file, a log line. The classic way is a counter: the first user is 1, the second is 2, and so on. That works fine when one database hands out the numbers. It breaks as soon as two systems create records at the same time without talking to each other. Both will hand out the number 42 and you now have a conflict.
A UUID solves this by being so large and so random that two machines can generate IDs independently, forever, and never produce the same one. There is no central authority, no lock and no network call. Any device, from a phone to a server, can mint a UUID on its own and trust that it is unique.
How big is 128 bits?
128 bits gives about 340 undecillion possible values. Written out that is 340 followed by 36 zeros. If every person on Earth generated a billion UUIDs every second, it would take trillions of years before a repeat became likely. In practice you can treat collisions as impossible. We look at the actual math in Can Two UUIDs Collide?.
Reading the format
Most of the digits are either random or derived from a timestamp, but two small pieces carry meaning:
- The version digit. The first character of the third group tells you which algorithm made the UUID. In the example above it is a 4, so this is a version 4 random UUID. Versions 1, 4 and 7 are the ones you will meet most often.
- The variant digits. The first character of the fourth group is 8, 9, a or b for every standard UUID. It marks the layout as the one defined by the RFC.
Everything else depends on the version. A version 4 UUID is 122 bits of randomness. A version 7 UUID starts with a millisecond timestamp so that newer IDs sort after older ones. A version 1 UUID mixes a timestamp with the network card address of the machine that made it. Our guide to all UUID versions goes through each one.
Where UUIDs are used
- Database primary keys, especially when rows are created on many servers or on client devices before they reach the database.
- API resource IDs. A URL like
/orders/9b2f...does not reveal how many orders exist, unlike/orders/1042. - File and asset names in object storage, so uploads never overwrite each other.
- Session tokens, trace IDs and message IDs in distributed systems where requests hop across many services.
- Hardware and software identifiers. Windows uses them everywhere under the name GUID, which is the same thing. See UUID vs GUID.
Where UUIDs are a poor fit
They are not free. A UUID takes 16 bytes of storage against 8 for a 64 bit integer, and 36 bytes when stored as text. They are hard for humans to read aloud or type. Random ones also scatter writes across a database index, which hurts insert performance on large tables. If you are choosing a primary key, read Should You Use UUIDs as Primary Keys? before deciding.
The standard behind them
UUIDs were first standardised in RFC 4122 in 2005. In 2024 that document was replaced by RFC 9562, which kept the old versions and added versions 6, 7 and 8. When someone says a UUID is "RFC compliant" they mean it follows the layout in that document.
Try one
The fastest way to get a feel for UUIDs is to generate a few. Our free UUID generator makes v1, v4 and v7 UUIDs in your browser, one at a time or fifty at once. Notice how the v7 ones share the same leading digits when generated close together, while v4 ones look completely unrelated.