What 100 million UUIDs tells you
UUID v4 has 122 random bits after its version and variant are set. Under independent, uniform generation, there are N = 2^122 possible values.
For two IDs, the chance that they match is 1/N. A collection of n IDs contains n(n−1)/2 pairs. That is why the risk for a collection differs from the risk for a single pair.
For 100 million UUID v4 values, the birthday approximation gives a collision probability of about 9.4 × 10^-22. This is an estimate under stated assumptions, not a report of an experiment performed by FastUUID.
The birthday formula
The probability of at least one matching pair is approximately:
p ≈ 1 − exp(−n(n−1)/(2N))
N = 2^122Use the UUID collision calculator to try counts and generation rates. Its implementation uses expm1 to avoid rounding very small probabilities to zero.
The number of IDs for a 50% probability is approximately:
n50 ≈ sqrt(2 × N × ln(2)) ≈ 2.715 × 10^18At one billion per day, that is roughly 7.43 million years, using 365.25 days per year. The expression sqrt(pi × N / 2) estimates the expected waiting time to the first collision; it is not the 50% threshold.
What can invalidate the estimate?
Truncating an identifier reduces its keyspace. Faulty random generators, state copied between processes, duplicate application requests, or incorrectly compared values can also cause problems that this ideal model does not describe.
Normalise representations before comparison. For instance, uppercase and lowercase UUID strings may represent the same identifier. Compare the same value in a consistent representation rather than generating two new values as part of the comparison.
Use a maintained implementation and a cryptographically secure source of randomness. Keep a uniqueness constraint where the application's data model requires one, and define how the application handles a conflict.
Testing has a different purpose
A test that finds no duplicates can catch some implementation bugs, but cannot prove that future values will never collide. Test format, version, variant, known examples, and application behaviour on duplicate insertion as well as sample uniqueness.
UUID v5 intentionally repeats when its name and namespace repeat. UUID v7 and ULID include timestamps and have different probability models. Do not apply this v4 calculator to those formats without analysing their generation schemes.
Choose the identifier for the task
Use UUID v4 for random identifiers, or consider UUID v7 when time ordering is useful. An identifier is not an authentication credential: access control must not rely on UUID possession alone.
The bit layouts, collision considerations, and randomness guidance are defined in RFC 9562.
Correction note
This article was revised on 10 September 2026 to remove unsupported experimental claims and correct the collision formula and time calculation. Its established URL is retained.