What is a UUID? — The complete 2026 guide
A UUID (Universally Unique Identifier) is a 128-bit value used to identify something — a database row, a file, a message — without coordinating with a central authority. This page covers the format, all eight versions, the new RFC 9562 spec from 2024, and how to pick the right version for your use case.
The UUID format
A UUID is 128 bits = 16 bytes = 32 hexadecimal digits. The canonical string form groups those 32 digits as 8-4-4-4-12 with hyphens, producing a 36-character string:
xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx
└──────┘ └──┘ └──┘ └──┘ └──────────┘
8 4 4 4 12 hex digits per group
M = version (1, 3, 4, 5, 6, 7, or 8)
N = variant (8, 9, a, or b for the standard RFC variant)The version digit (the 13th hex character) tells you which algorithm generated the UUID. The variant nibble (the 17th hex character) tells you which UUID standard the value follows — for the IETF/RFC variant this is always 8, 9, a, or b.
The eight UUID versions at a glance
| Version | Source | Sortable? | Use when… |
|---|---|---|---|
| v1 | timestamp + clock seq + node | No (string), Yes (binary) | …interoperating with legacy v1 data. |
| v3 | MD5(namespace + name) | No | …deterministic ID from a name (legacy; prefer v5). |
| v4 | CSPRNG random | No | …default; public IDs, tokens, file names. |
| v5 | SHA-1(namespace + name) | No | …deterministic ID from a name (preferred over v3). |
| v6 | reordered v1 | Yes | …migrating v1 data to a sortable form. |
| v7 | unix-ms timestamp + random | Yes | …database primary keys; modern default for ordered IDs. |
| v8 | vendor-defined | Depends | …custom layouts (rarely needed). |
What changed in RFC 9562 (May 2024)
RFC 9562 obsoletes RFC 4122. The three biggest changes:
- v6, v7, v8 are introduced. v6 and v7 fill the long-running gap of "sortable UUID"; v8 is for custom layouts.
- v1 / v2 / v3 / v5 remain compatible. Existing UUIDs do not need to be regenerated.
- v2 is deprecated. v2 was always an obscure DCE Security variant; RFC 9562 documents but discourages it.
Collision probability
The standard birthday-bound calculation: with N possible values, generating √N values gives a ~50% chance of any collision. For UUID v4 with 2^122 possibilities, that's about 2.7 × 10^18 UUIDs — generating one billion every second for 85 years before a single collision becomes more likely than not.
For all practical purposes, UUID v4 collisions are impossible. Application bugs, faulty PRNGs, or rare hardware events are orders-of-magnitude more likely than the math suggests.
UUID by language and database — quick reference
JavaScript / Node 19+ crypto.randomUUID()
Python 3+ uuid.uuid4()
Java UUID.randomUUID()
C# / .NET Guid.NewGuid()
Go uuid.NewRandom() // github.com/google/uuid
Rust Uuid::new_v4() // uuid crate
PHP Ramsey\Uuid\Uuid::uuid4() // ramsey/uuid
Ruby SecureRandom.uuid
Kotlin UUID.randomUUID()
Swift UUID()
Bash uuidgen
PowerShell [guid]::NewGuid()
PostgreSQL 13+ gen_random_uuid()
MySQL UUID()
SQL Server NEWID()
Oracle SYS_GUID()
SQLite lower(hex(randomblob(16))) -- assemble manuallyNode.js import { v7 } from 'uuid'; v7()
Python 3.13+ uuid.uuid7()
Java JDK 21+ (proposal JDK-8357251) UUID.randomUUIDv7()
Go uuid.NewV7() // github.com/google/uuid
Rust Uuid::now_v7() // uuid crate v1+, v7 feature
PostgreSQL 18+ uuidv7()