UUID Explained: What It Is and When to Use One
What a UUID actually is, how v4 random generation works, and when to reach for a UUID instead of an auto-increment ID.
6 min read
Last updated 2026-07-19
Luis Avila
UUID Explained: What It Is and When to Use One explains UUIDs and identifier design from the concepts that matter most to the decisions you make in practice. It focuses on how the technology works, where it fits, the tradeoffs to check, and how to avoid results that look correct but fail in a real workflow.
What will this guide cover?
- What is a UUID?
- Versions and their meaning
- Where are UUIDs useful?
- Database considerations
- Practical example
- Generation and validation
- Collisions and misconceptions
What is a UUID?
A UUID is a 128-bit identifier usually written as 32 hexadecimal characters separated by hyphens, such as 550e8400-e29b-41d4-a716-446655440000. It is designed to be generated independently with an extremely low risk of collision, making it useful when systems cannot coordinate a central numeric sequence.
Versions and their meaning
UUID versions describe how the identifier is produced. Version 4 is random, version 7 is time-ordered with random data, and older versions may include timestamps or namespace-based hashes. The version is visible in specific bits, so a string that looks like a UUID is not necessarily generated correctly.
Where are UUIDs useful?
UUIDs are common for database records, distributed events, upload names, idempotency keys, and public identifiers. They reduce coordination between services and are harder to enumerate than sequential integers. They do not provide authorization or secrecy, a known UUID should still be treated as a normal identifier.
Database considerations
Random UUIDs can fragment B-tree indexes because new values are inserted throughout the index. Time-ordered variants such as UUIDv7 improve insertion locality. Store UUIDs in a native UUID or 16-byte binary column when supported rather than a longer text field, and benchmark the indexing pattern that matches the workload.
Practical example
A client can generate an order UUID before sending a request, then reuse it as an idempotency key if the request is retried. The server can detect that the same operation was already processed and avoid creating a duplicate order.
Generation and validation
Use the platform’s cryptographically secure UUID implementation rather than Math.random or a handwritten template. Normalize accepted text format, validate the version when it matters, and keep identifiers immutable after creation. Do not derive access control decisions from whether an ID appears unpredictable.
Collisions and misconceptions
UUID collisions are extraordinarily unlikely with correct random generation, but they are not mathematically impossible. Keep a uniqueness constraint in the database. UUIDs are not automatically sortable, compact, private, or secure tokens, those properties depend on the version and surrounding design.
Frequently Asked Questions
Universally Unique Identifier. It is a 128-bit value commonly displayed as 32 hexadecimal characters separated by hyphens.
No absolute guarantee exists, but correctly generated random UUIDs have an extremely low collision probability. Uniqueness also depends on using a reliable generator and not truncating the value.
Version 4 is random. Version 7 combines a timestamp with random data, producing identifiers that sort roughly by creation time and often behave better in database indexes.
They can be useful in distributed systems and offline creation. Random UUIDs may fragment ordered indexes, so consider UUID v7, database-specific ordered formats, or a separate internal numeric key when write performance matters.
No. A UUID may be hard to guess, but it is still an identifier, not an authorization mechanism. Protect resources with proper authentication and access checks.
Some versions can. Version 1 includes timestamp and node-related information. Version 7 reveals approximate creation time. Version 4 does not intentionally encode metadata.
Binary storage is more compact and can improve indexing, while text is easier to inspect and exchange. Use the database’s native UUID type when available.
Related Guides
Identifiers & Security
SHA-256 Explained: How Hashing Works and Why It Matters
What SHA-256 does, how it differs from encryption, and where it shows up in everyday software, from passwords to Git commits.
7 min read Identifiers & SecurityHow to Create a Strong Password (and Actually Remember It)
What makes a password hard to crack, why length beats complexity, and how a password manager changes the whole equation.
6 min read