Generate UUIDs

Version 4 or version 7?

A UUID is a 128-bit identifier, usually written as 32 hex digits in groups of 8, 4, 4, 4 and 12. Two versions cover almost every new use:

• Version 4 is random. Six bits are fixed to mark the version and variant, and the other 122 bits come from the secure random generator. It tells you nothing about when it was made.
• Version 7 starts with a 48-bit Unix timestamp in milliseconds, followed by random bits (74 of them, part of which this page uses as a counter). Newer IDs sort after older ones, so inserts land at the end of an index instead of all over it.

For a database primary key on a large table, version 7 usually keeps indexes smaller and inserts faster than version 4. The price is that the creation time is visible in the ID, so do not use it where that would give something away. Neither version is a secret: do not use a UUID as a password or an API key. A password generator is the right tool for that.

How unlikely is a collision?

A version 4 UUID has 122 random bits, which is about 5.3 undecillion possible values (5.3 followed by 36 zeros). By the birthday bound you would need to generate roughly 2.7 quintillion of them before the chance of any two matching reaches 50 percent. At a billion UUIDs a second that would take about 86 years.

In practice the maths is not the risk. A badly seeded random generator is, which is why this page never uses Math.random and takes every bit from the browser's cryptographic source.

Reading a UUID

You can tell the version by eye. In 123e4567-e89b-42d3-a456-426614174000 the first digit of the third group, 4, is the version. The first digit of the fourth group, a, shows the variant: 8, 9, a or b means the standard layout used today.

Version 1, 6 and 7 UUIDs carry a time. Paste one into Read a UUID to see when it was made. This is handy for checking when a record was created from its ID alone, and for confirming that version 7 IDs from your own system hold the time you expect.

Formats and where they are used

• Standard: lowercase with hyphens, the form in most APIs and in PostgreSQL's uuid type.
• Uppercase: common in Windows tools and SQL Server's uniqueidentifier.
• No hyphens: 32 characters, used where hyphens are awkward, such as some file names. This is .NET's N format.
• Braces: the Windows registry and COM style, .NET's B format.
• URN: urn:uuid: followed by the standard form, the name-based form the UUID standards define.
• Base64 URL: 22 characters with no padding, shorter in links and QR codes. The UUID is converted bit for bit, so it decodes back to the same value.

Whatever the text looks like, store UUIDs in a native uuid or 16-byte binary column when your database has one. Text storage takes more than twice the space.