What Is a UUID? Why Every Developer Needs to Know This

A UUID (Universally Unique Identifier) is a 128-bit value used to label something so that it's effectively unique across space and time — without any central server handing out numbers. You've seen them everywhere: 550e8400-e29b-41d4-a716-446655440000. Database primary keys, API resource IDs, session tokens, uploaded filenames, log correlation IDs — all UUIDs. The magic is that two different machines, with no network connection between them, can each generate a UUID and trust that the two values will never collide. That property is what makes UUIDs the default identifier for modern distributed systems. Need one right now? The free UUID Generator on UtilToolkits produces RFC 4122 / 9562 UUIDs in your browser — nothing uploaded, nothing logged.

What Is a UUID?

UUID stands for Universally Unique Identifier. Microsoft calls the same thing a GUID (Globally Unique Identifier) — they are functionally identical. A UUID is 128 bits of data, conventionally written as 32 hexadecimal digits split into five dash-separated groups in an 8-4-4-4-12 pattern:

550e8400-e29b-41d4-a716-446655440000
└──────┘ └──┘ └──┘ └──┘ └──────────┘
   8      4    4    4        12      = 32 hex digits = 128 bits

The whole point of a UUID is uniqueness without coordination. A traditional auto-increment integer primary key (1, 2, 3…) needs a single database to be the authority on "what's the next number." UUIDs need no authority at all — there are 2¹²⁸ possible values (about 340 undecillion), so the odds of two randomly generated UUIDs colliding are astronomically small. That's why they're indispensable the moment you have more than one thing minting IDs: read replicas, sharded databases, microservices, offline-first mobile apps, or multi-region writes.

One thing a UUID is not: a secret. A version-4 UUID is unguessable, but if you put it in a URL, treat it as semi-public — anyone the link reaches can use it.

How a UUID Works — and the Versions That Matter

Not all UUIDs are built the same way. The "version" digit — the first character of the third group — tells you how the value was generated. In practice, two versions cover almost everything you'll build in 2026:

Version	How it's built	Use it for
v1	Timestamp + host MAC address	Legacy only — leaks the machine's MAC. Avoid.
v4	122 bits of cryptographic randomness	Tokens, session IDs, ad-hoc identifiers — anywhere unpredictability matters
v7	48-bit Unix-ms timestamp + 74 random bits	Database primary keys — sortable and index-friendly

Version 4 is the one you'll see most. It's almost entirely random: 122 of the 128 bits come from a cryptographically secure random source, with 6 bits reserved to mark the version and variant. Here's how every major platform generates one:

// JavaScript (browsers + Node.js 19+)
crypto.randomUUID();
// → '9b2f0c7e-4f3a-4d2b-8c1e-2a6f5d8e1b30'

// Python 3
import uuid
uuid.uuid4()
# → UUID('f47ac10b-58cc-4372-a567-0e02b2c3d479')

// PostgreSQL 13+
SELECT gen_random_uuid();

// Go
import "github.com/google/uuid"
uuid.New()

Version 7 was standardized in RFC 9562 (2024) to solve a real performance problem: v4's pure randomness scatters inserts all over a B-tree index, hurting write throughput on large tables. v7 prefixes a millisecond timestamp, so new rows sort by creation time and land at the end of the index — keeping uniqueness while restoring locality. The simple rule: v4 for tokens, v7 for primary keys. For the full breakdown, see UUID v4 vs v7: Which Version Should Your App Use? →

Common Use Cases for UUIDs

• Database primary keys. Replace auto-increment integers so records can be created on any node, in any region, or on a client device that's currently offline — no collisions when they sync.
• API resource identifiers. /users/9b2f0c7e-... instead of /users/4823. Sequential integers leak how many users you have and invite enumeration scraping; UUIDs don't.
• Session and request IDs. A v4 UUID per session or per request gives you an unguessable token and a clean key for correlating logs across services.
• Idempotency keys. Clients send a UUID with a payment or order request so the server can safely de-duplicate retries.
• File and object names. Naming uploads with a UUID avoids collisions and stops users from overwriting each other's files in shared storage.
• Distributed tracing. A single trace ID (often a UUID) threads one user action through dozens of microservices.

When you need to actually create these in code across languages, see How to Generate a UUID in JavaScript, Python, and Go →

Try It on UtilToolkits

The UUID Generator runs entirely in your browser using the same crypto.getRandomValues() CSPRNG that backs TLS in Chrome and Firefox:

• Generate v4 (random) or v7 (time-ordered) UUIDs with one click
• Bulk-generate 1–1000 at once and export as JSON, CSV, or newline-delimited text
• Copy a single value instantly for pasting into code, configs, or test fixtures
• Nothing is uploaded or logged — and it works offline once the page has loaded

Building anything security-sensitive? Pair it with the Hash Generator for checksums.

FAQ

What does UUID stand for?

Universally Unique Identifier. It's a 128-bit value designed to be unique across all devices and time without needing a central registry. Microsoft's GUID (Globally Unique Identifier) is the same thing under a different name.

Are UUIDs truly unique?

Not mathematically guaranteed, but practically yes. With version 4, you'd need to generate about 1 billion UUIDs every second for roughly 85 years to have even a 50% chance of a single collision. For any real application, treat them as unique.

What's the difference between a UUID and a GUID?

None functionally. GUID is Microsoft's term for the same 128-bit identifier defined by the UUID standard. A value generated as a UUID works anywhere a GUID is expected, and vice versa.

Should I use a UUID or an auto-increment integer for my database?

Use a UUID (ideally v7) when records are created across multiple servers, regions, or offline clients, or when you don't want IDs to leak row counts. Stick with integers for a simple single-server app where sequential keys and minimal storage matter most. More on this: UUID vs ULID: Complete Developer Comparison →

UUIDs are the quiet workhorse of distributed software — unique IDs no server has to coordinate. Now that you know what they are and which version to reach for, grab one from the UUID Generator: instant, browser-based, no signup, no trace.