What is a UUID?
A Universally Unique Identifier is a 128-bit value used to label a resource, such as a document, account, or event. GUID is another common name for the same kind of identifier. UUID generation can avoid a shared central sequence, which is useful when different services create records independently.
Uniqueness is a design objective, not a promise that any generator or dataset is error-free. Randomness failures, copied data, and application bugs can still produce duplicates. A UUID also does not establish ownership or grant access to a resource.
Read the format
550e8400-e29b-41d4-a716-446655440000The familiar text form has 32 hexadecimal digits in groups of 8-4-4-4-12, plus four hyphens: 36 characters representing 16 bytes. In this example, the first digit of the third group is 4, indicating version 4. The variant bits must also be checked before interpreting the layout. These fields are defined in RFC 9562.
The UUID validator can inspect formatting, version, and variant. It cannot check whether an ID has already been used in your database or whether its claimed timestamp is truthful.
Choose a version for the task
| Version | Main purpose | Important limitation |
|---|---|---|
| v1 | Timestamp and node-based generation | Can reveal time and node information |
| v3 / v5 | Repeatable namespace-and-name identifiers | Same inputs intentionally give the same result |
| v4 | Random identifiers | Does not encode creation order |
| v6 | Reordered v1-style timestamp layout | Still includes a node field |
| v7 | Unix timestamp with fields for uniqueness | Reveals time; not a global event sequence |
| v8 | Application-defined layout | Requires knowledge of the custom format |
This is a practical selection table, not a complete registry of legacy formats. Start with v4 for ordinary opaque resource IDs. Consider v7 for timestamp-oriented indexing, and v5 when separate systems must derive the same ID from an agreed namespace and name. Do not choose v5 as a password hash merely because it uses SHA-1.
The Python UUID documentation provides generation and parsing APIs for these common versions.
Generate and inspect UUIDs in Python
This example uses the standard library and works without an extra package:
import uuid
random_id = uuid.uuid4()
name_id = uuid.uuid5(uuid.NAMESPACE_DNS, "example.com")
assert random_id.version == 4
assert uuid.UUID(str(random_id)) == random_id
assert name_id == uuid.UUID("cfbff0d1-9375-5685-968c-48ce8b15ae17")
print(random_id)
print(name_id)The random output changes; the name-based output stays the same. Agree on the namespace, capitalization, and normalization rules before using names as IDs. The API does not infer your application's naming rules.
Generate UUIDs in Node.js
Node's built-in crypto module can generate v4 identifiers:
import { randomUUID } from 'node:crypto';
const id = randomUUID();
console.log(id);Save this as an .mjs file and run it with Node. The Node crypto reference documents its cryptographic random source. For v5 or v7, use a maintained UUID library; the v7 guide includes a working example.
For an interactive example, use the v4 generator or v5 generator.
How likely is a collision?
Version 4 has 122 random bits after the version and variant fields. For independent, uniformly random draws, the birthday approximation for at least one collision among n IDs is:
p ≈ 1 - exp(-n(n - 1) / (2 × 2^122))At one billion IDs, the probability is approximately 9.4 × 10^-20, or 9.4 × 10^-18%. But generating one billion per second for 100 years is a very different total: roughly 3.16 × 10^18 IDs, giving about a 61% probability under the same model. A very low per-pair probability does not stay negligible at arbitrary scale.
Try the collision calculator and read the collision probability explanation. The calculation assumes a correct random generator; it does not account for duplicated requests or broken randomness.
Store and use identifiers deliberately
Keep uniqueness constraints in the database and handle duplicate-key failures. Prefer a native UUID type or a consistent binary representation when appropriate; see the binary storage guide. Never truncate an identifier while assuming its collision properties remain unchanged.
A resource UUID is not a session-management design. Use your authentication framework's token facilities and enforce object permissions, even when IDs are hard to guess. The multi-tenant guide shows why an identifier and an access boundary are different things.