FakecreditcardWhat a UUID is
A UUID (universally unique identifier) is a 128-bit number written as 32 hexadecimal digits in five groups, 8-4-4-4-12, for example f47ac10b-58cc-4372-a567-0e02b2c3d479. Systems create UUIDs independently, without asking a central server, and can still be practically certain that no two are the same. That makes them the usual choice for database keys in distributed systems, idempotency keys for APIs, file names and correlation IDs in logs. The current standard is RFC 9562 (2024), which replaced RFC 4122 and added versions 6, 7 and 8.
Two places in every UUID say how it was made. The first digit of the third group is the version (the 4 in 4372). The first digit of the fourth group holds the variant: for standard UUIDs it is 8, 9, a or b. The decoder above reads both and, for version 7, the embedded timestamp.
UUID v4 vs UUID v7
| Version 4 | Version 7 | |
|---|---|---|
| Built from | 122 random bits | 48-bit Unix timestamp in milliseconds + 74 random or counter bits |
| Sort order | Random | Creation time (k-sortable) |
| Database keys | Inserts land all over the index: more page splits and cache misses on large tables | Inserts append to the end of the index, like an auto-increment column |
| Leaks creation time | No | Yes, to the millisecond |
| Best for | Public identifiers, tokens in URLs, anything that shouldn’t reveal timing | Primary keys, event IDs, anything you sort or page by time |
Version 1 (MAC address + time) is still found in older systems but exposes the generating machine’s hardware address; v6 reorders v1’s timestamp to make it sortable. For new designs RFC 9562 recommends v7 over v1 and v6.
How this generator creates UUIDs
Version 4: 16 random bytes from crypto.getRandomValues, the browser’s cryptographically secure generator, then the version nibble is set to 0100 and the variant bits to 10. This is the same method as crypto.randomUUID().
Version 7: the first 48 bits are the current time in milliseconds since 1970, followed by the version 0111, a 12-bit counter, the variant and 62 random bits. When several UUIDs are created in the same millisecond — which happens in every bulk batch — the counter is incremented, as described in RFC 9562 section 6.2 (method 1). So a batch of v7 UUIDs is strictly increasing when sorted as text.
Nothing is sent to a server: the UUIDs exist only in your browser until you copy or download them.
Formats
- Standard (lower case, hyphens):
3f2b8c1e-…— what RFC 9562 recommends for output and what PostgreSQL’suuidtype returns. - Upper case: common in .NET and SQL Server (where UUIDs are called GUIDs). Parsers must accept both cases.
- No hyphens: 32 hex digits, used in some URLs, file names and in MySQL’s
UNHEX()to store a UUID inBINARY(16). - Braces
{…}: the Windows registry and COM style. URNurn:uuid:…: for XML and RDF identifiers.
Generating UUIDs in code
- JavaScript (browsers, Node.js 19+):
crypto.randomUUID()returns a v4 UUID. - Python:
uuid.uuid4();uuid.uuid7()from Python 3.14. - PostgreSQL:
gen_random_uuid()(v4);uuidv7()from PostgreSQL 18. - Java:
UUID.randomUUID(). .NET:Guid.NewGuid(), andGuid.CreateVersion7()in .NET 9.
Need UUIDs as IDs inside complete records? The test data generator can use v4, v7 or integers as the id column.
Frequently asked questions
Should I use UUID v4 or v7?
Use v7 for database primary keys: its first 48 bits are a millisecond timestamp, so new keys sort in creation order and B-tree indexes stay compact. Use v4 when the identifier must not reveal when it was created, for example in public URLs or tokens.
Are the UUIDs unique?
A v4 UUID has 122 random bits. You would need to generate about 2.7 × 1018 of them to reach a 50% chance of a single duplicate. v7 has 74 random or counter bits per millisecond, and this generator increments a counter within the same millisecond, so a bulk batch is strictly increasing.
Is a UUID the same as a GUID?
Yes. GUID is Microsoft’s name for the same 128-bit format. .NET and SQL Server usually show GUIDs in upper case and sometimes in braces, which you can select above.
Are UUIDs secure tokens?
No. A v4 UUID is hard to guess when it comes from a cryptographic generator, but UUIDs are not designed as secrets. For session tokens or password reset links use a dedicated random token with at least 128 bits of entropy.