Table of contents
Every record in a database needs a unique identifier. Every API resource needs a stable reference. Every distributed system needs IDs that do not collide even when generated by different machines simultaneously. UUIDs solve all three problems with a single, standardized format.
This guide explains what UUIDs are, how they work, when to use them, and how to generate them instantly online.
What is a UUID?
A UUID (Universally Unique Identifier) is a 128-bit identifier formatted as a sequence of hexadecimal characters:
550e8400-e29b-41d4-a716-446655440000
The format is always 32 hexadecimal characters in five groups, separated by hyphens: 8-4-4-4-12 characters. This produces a string that is:
- Unique: The probability of two randomly generated UUIDs being identical is astronomically low
- Stateless: Generated without coordination between systems — no central registry, no database query
- Portable: Works as a string in any programming language, database, URL, or log file
UUIDs are sometimes called GUIDs (Globally Unique Identifiers) — the same format, just Microsoft's name for it.
To generate a UUID immediately, use the FixTools UUID Generator.
UUID versions
There are several UUID versions, each generated differently:
UUID v4 (random)
The most widely used version. 122 bits of random data, 6 bits reserved for version and variant. Every call produces a completely random value with no relationship to previous UUIDs, the generating machine, or the timestamp.
f47ac10b-58cc-4372-a567-0e02b2c3d479
Use v4 for: user IDs, session tokens, record identifiers, API keys.
UUID v1 (time-based)
Encodes the current timestamp (in 100-nanosecond intervals since October 1582) and the MAC address of the generating machine. Unique across time and machines, but leaks information about when and where it was generated.
Use v1 for: systems where you need to recover the generation timestamp from the ID itself.
UUID v5 (name-based, SHA-1)
Deterministic: given the same namespace and name inputs, always produces the same UUID. Used when you want a UUID for a specific resource (a URL, a username) that stays consistent.
Use v5 for: content-addressable identifiers, stable IDs for known entities.
UUID v7 (time-ordered, newer standard)
A newer format that is sortable by generation time (like v1) but does not expose the MAC address (unlike v1). Ideal for database primary keys because time-ordered UUIDs append to B-tree indexes efficiently rather than scattering randomly.
Use v7 for: database primary keys where both uniqueness and sort order matter.
How to generate a random UUID
Online: Use the FixTools UUID Generator. Click once to generate a UUID, or specify a quantity to generate multiple at once — useful for seeding test data or pre-generating IDs for a batch operation.
In code:
JavaScript (browser and Node.js 14.17+):
const id = crypto.randomUUID();
// Returns something like: '3b12f1df-5232-4804-897e-917bf397618a'
Python:
import uuid
id = str(uuid.uuid4())
# '3b12f1df-5232-4804-897e-917bf397618a'
Node.js (with the uuid package):
import { v4 as uuidv4 } from 'uuid';
const id = uuidv4();
Go:
import "github.com/google/uuid"
id := uuid.New().String()
SQL (PostgreSQL has a built-in function):
SELECT gen_random_uuid();
-- f47ac10b-58cc-4372-a567-0e02b2c3d479
When to use UUIDs
Database primary keys
The traditional alternative is an auto-increment integer (1, 2, 3...). Auto-increment is simple and index-friendly, but has limitations:
- The next ID requires a database round-trip to obtain
- IDs are sequential, which reveals information (a user with ID 3 tells you this is an early user)
- Merging data from multiple databases produces collisions
UUIDs eliminate all three problems. The application can generate an ID before inserting a record, multiple databases can merge without ID conflicts, and IDs reveal nothing about the record's position in the dataset.
Distributed systems
When multiple services, servers, or clients generate IDs independently, they need a strategy that guarantees uniqueness without coordination. UUID v4's statistical uniqueness makes coordination unnecessary — each service generates IDs locally with no risk of collision.
Session and token identifiers
Login sessions, password reset tokens, email verification links, and OAuth tokens all benefit from being UUID-formatted: long enough to be unguessable, short enough to fit in a database column or URL, and standardized enough to work across any language or framework.
Referencing resources in APIs
REST API endpoints commonly use UUIDs to identify resources:
GET /api/users/f47ac10b-58cc-4372-a567-0e02b2c3d479
GET /api/documents/550e8400-e29b-41d4-a716-446655440000
This avoids exposing sequential integer IDs that reveal business information (total user count, order volume) and prevents users from guessing adjacent IDs.
Test data and fixtures
When seeding a development database, a staging environment, or unit test fixtures, you need IDs that are unique but do not conflict with each other or with production data. Generating a batch of UUIDs is faster than manually assigning sequential IDs and prevents accidental collisions if environments share infrastructure.
UUID vs. other ID formats
| Format | Example | Unique? | Sortable? | Short? |
|---|---|---|---|---|
| UUID v4 | f47ac10b-58cc-... |
Yes (random) | No | No (36 chars) |
| UUID v7 | 018e5b09-... |
Yes | Yes (time-ordered) | No |
| ULID | 01ARZ3NDEKTSV4RRFFQ69G5FAV |
Yes | Yes | Similar |
| Snowflake ID | 1541815603606036480 |
Yes (distributed) | Yes | Similar |
| Auto-increment | 42 |
Within one DB | Yes | Yes |
| NanoID | V1StGXR8_Z5jdHi6B-myT |
Yes (random) | No | Shorter |
UUID v4 is the default choice when you need universally unique IDs and do not need sort order. Use UUID v7 or ULID when you need time-ordered IDs for database performance.
Common UUID mistakes
Storing UUIDs as strings in a database
A UUID string is 36 characters (32 hex + 4 hyphens). Most databases have a native UUID type (PostgreSQL UUID, MySQL BINARY(16)) that stores the 16 raw bytes instead — half the storage and faster index lookups. Using VARCHAR(36) for UUIDs wastes space and slows queries on large tables.
Using UUID v1 without understanding the privacy implications
UUID v1 encodes the MAC address of the generating machine. If you generate UUID v1 in a client application and include it in logs or API calls, you are leaking the client's hardware identifier. Use v4 for any ID generated on user devices.
Validating UUIDs with a regex that is too loose
A UUID is a specific format. The regex [0-9a-f-]{36} will match it but also match many invalid strings. The correct pattern enforces the group lengths and the version/variant bits:
^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
This validates UUID v4 specifically (the 4 in the third group and [89ab] at the start of the fourth group).
Generate a UUID now
Use the FixTools UUID Generator to generate one UUID or a batch of UUIDs instantly. Copy individual values or download a list — useful for seeding databases, creating test fixtures, or pre-generating IDs for an import. For broader dummy data including names, emails, and numbers, the Dummy Data Generator generates structured test records you can use directly.
Try it free — right in your browser
No sign-up, no uploads. Your data stays private on your device.
Frequently asked questions
6 questions answered
QWhat is the difference between a UUID and a GUID?
UUID (Universally Unique Identifier) and GUID (Globally Unique Identifier) refer to the same 128-bit identifier format. UUID is the official term defined by RFC 4122. GUID is Microsoft's name for the same concept, used in Windows and the .NET ecosystem. Both are formatted as 32 hexadecimal characters in five groups: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. When developers say GUID, they mean UUID — the two terms are interchangeable in practice.
QHow unique is a UUID v4 really?
UUID v4 is generated from 122 bits of random data (6 bits are reserved for version and variant). The total number of possible v4 UUIDs is 2^122, which is approximately 5.3 × 10^36. To have a 50% probability of a single collision, you would need to generate around 2.71 × 10^18 UUIDs — that is 2.71 quintillion. At a rate of one billion UUIDs per second, it would take about 85 years to reach that point. For all practical purposes, UUID v4 collisions do not happen.
QShould I use UUID v1 or UUID v4?
Use UUID v4 for most new projects. UUID v4 is randomly generated and reveals no information about the host system or the time of generation. UUID v1 is time-based — it encodes the timestamp and the MAC address of the machine that generated it. While v1 guarantees uniqueness across time and machines, it leaks information about when and where it was created, which is a privacy concern. UUID v4 is the modern default for most use cases. UUID v7 (a newer standard) is time-ordered like v1 but without the MAC address, making it better for database indexing.
QAre UUIDs safe to use as primary keys in a database?
Yes, but with trade-offs to understand. The main advantage is that UUIDs can be generated by the client or application layer without a round-trip to the database to get the next auto-increment value — useful for distributed systems and offline-first applications. The trade-off is index fragmentation: UUID v4 is random, so consecutive inserts go to random positions in a B-tree index rather than appending to the end. This causes more page splits and can degrade performance on high-write tables. UUID v7 solves this by being time-ordered while still being unique.
QWhat does the format of a UUID mean?
A UUID is 128 bits (16 bytes) formatted as 32 hexadecimal characters separated into five groups by hyphens: 8-4-4-4-12. For example: 550e8400-e29b-41d4-a716-446655440000. In UUID v4, the 13th character of the third group is always 4 (indicating version 4), and the 17th character (first of the fourth group) is always 8, 9, a, or b (indicating the variant). All other characters are random. The hyphens are a formatting convention — the underlying identifier is just 128 bits of data.
QCan I use a UUID as a URL slug?
Technically yes, but it is not recommended for user-facing URLs. A URL like /posts/550e8400-e29b-41d4-a716-446655440000 is not memorable, not meaningful, and not good for SEO. UUIDs work well as internal identifiers — in the database, in API calls, in API responses — but URLs that users see or share should use readable slugs. The common pattern is to use a UUID as the internal ID and a separate slug column for the URL.
O. Kimani
Software Developer & Founder, FixTools
Building FixTools — a single destination for free, browser-based productivity tools. Every tool runs client-side: your files never leave your device.
About the authorRelated articles
Best Free JSON Formatter and Validator Online (2026)
Format messy JSON instantly and catch syntax errors before they break your app. Free browser-based JSON formatter and validator. No signup, no install.
Read articleUtilitiesBase64 Encode and Decode Explained (With Free Online Tool)
Base64 encoding converts binary data into ASCII text so it can be safely transmitted over text-based systems. Learn how it works, when to use it, and how to encode or decode instantly online.
Read article