What Is a UUID? Understanding Universally Unique Identifiers

What Does UUID Stand For?

UUID stands for Universally Unique Identifier, though the newer RFC 9562 specification uses the term Universally Unique IDentifier. Regardless of naming, the concept is the same: a standardized format for generating identifiers that are unique across space and time, without coordination between the parties generating them.

The UUID Format

A UUID is a 128-bit value displayed as 32 hexadecimal characters arranged in five groups separated by hyphens:

550e8400-e29b-41d4-a716-446655440000
xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx

• The M digit indicates the UUID version (1-8).
• The N digit indicates the variant (typically 8, 9, a, or b for RFC 4122 UUIDs).
• The remaining 122 bits carry the actual unique data.

The standard string representation uses lowercase letters, though uppercase is also valid.

UUID Versions Explained

Different versions serve different purposes:

• Version 1: Based on timestamp and MAC address. Guarantees uniqueness through time and hardware identity, but reveals the generating machine's MAC address.
• Version 2: Similar to v1 but with reduced time precision, embedding a POSIX UID. Rarely used.
• Version 3: Generated by hashing a namespace and name using MD5. Deterministic — the same input always produces the same UUID.
• Version 4: Completely random (or pseudo-random). The most commonly used version today. Relies on a good random number generator.
• Version 5: Like v3 but uses SHA-1 hashing instead of MD5. Preferred over v3 for new applications.
• Version 6: A rearranged version of v1 that sorts chronologically while maintaining uniqueness.
• Version 7: Timestamp-based with random padding, designed for database indexing. Sortable and modern.
• Version 8: Custom implementation allowing application-specific data embedding.

Why UUIDs Guarantee Uniqueness

A version 4 UUID has 122 random bits, yielding approximately 5.3 × 10³⁶ possible values. The probability of generating two identical UUIDs is astronomically low — comparable to the chance of a meteorite hitting your server room at the exact moment of collision.

Common Use Cases

• Database primary keys: UUIDs avoid the coordination problems of auto-incrementing integers in distributed databases.
• Session tokens: Web applications use UUIDs to identify user sessions without exposing sequential IDs.
• File naming: Systems that accept user uploads use UUIDs to prevent filename collisions.
• Distributed systems: Microservices generate UUIDs independently without risk of ID conflicts.
• API resource identifiers: RESTful APIs use UUIDs in URLs to prevent enumeration attacks.