← Back to Blog

What Is a UUID and Why Does Every App Use One?

Every time you sign up for a new app, create a database row, upload a file, or initiate an API request, something invisible happens: a unique identifier is assigned to that action or record. In modern software, the most common format for these identifiers is a UUID — and there is a very good chance you have seen one without knowing what it was. A UUID looks like this: 550e8400-e29b-41d4-a716-446655440000. Let us break down what that string means and why it matters.

What Is a UUID?

UUID stands for Universally Unique Identifier. It is a 128-bit number represented as 32 hexadecimal digits arranged in five groups separated by hyphens: 8-4-4-4-12. Despite being only 32 characters long, a UUID encodes a number so large that generating a duplicate by random chance is practically impossible.

UUIDs are standardised in RFC 4122. They are also called GUIDs (Globally Unique Identifiers) in Microsoft environments — same format, different name.

The Five UUID Versions

Version	Generation Method	Common Use
v1	MAC address + timestamp	Legacy systems; reveals device identity and time
v2	DCE security (POSIX UID)	Very rare; DCE RPC systems
v3	MD5 hash of namespace + name	Deterministic IDs from known inputs
v4	Random (cryptographic)	⭐ Most common — database keys, session IDs, API tokens
v5	SHA-1 hash of namespace + name	Deterministic IDs, more secure than v3

Version 4 dominates real-world usage because it requires no network address, no coordination between systems, and produces effectively guaranteed unique values from pure randomness.

How Unique Is a UUID v4 Really?

A UUID v4 uses 122 bits of randomness (the other 6 bits are fixed version and variant markers). The total number of possible v4 UUIDs is 2¹²² — approximately 5.3 × 10³⁶. To put that in perspective: if you generated one billion UUIDs per second, continuously, it would take roughly 100 billion years before a collision became statistically likely. For all practical purposes, UUID v4 collisions do not occur.

Reading a UUID

Take the UUID 550e8400-e29b-41d4-a716-446655440000:

• 550e8400 — first 8 hex digits (32 bits): time low (in v1) or random (in v4)
• e29b — 4 hex digits: time mid or random
• 41d4 — 4 hex digits: the first digit (4) indicates version 4
• a716 — 4 hex digits: the first hex digit (a = 1010 in binary) indicates the variant (RFC 4122)
• 446655440000 — 12 hex digits: node (MAC in v1) or random (in v4)

In any UUID, the 13th character reveals the version, and the 17th character reveals the variant. This is how libraries distinguish UUID versions programmatically.

Why UUIDs Instead of Auto-Increment IDs?

Traditional databases use auto-incrementing integers (1, 2, 3…) as primary keys. UUIDs offer several advantages in specific contexts:

• Distributed systems: Multiple servers or devices can generate IDs independently without a central counter — no coordination needed, no ID conflicts when merging.
• Security by obscurity: An auto-increment ID exposes information — if a user's ID is 1042, you know there are at least 1041 other users and can guess sequential IDs. UUIDs reveal nothing.
• Offline-first apps: Mobile apps can generate UUIDs for new records without a server round-trip, then sync later.
• Microservices: Each service can generate IDs independently; aggregated IDs from different services do not conflict.

Trade-offs: UUIDs are 36 characters versus a few digits for integers, which increases storage, index size, and reduces readability. Many high-scale databases use ULID (Universally Unique Lexicographically Sortable Identifier) as a sortable alternative that retains uniqueness while enabling range queries.

Where You Will See UUIDs

Database Primary Keys

PostgreSQL has a native uuid column type. MySQL stores them as CHAR(36) or binary. Most ORMs (Sequelize, Hibernate, SQLAlchemy) support UUID generation natively.

Cloud Storage and File Uploads

When you upload a profile picture or document, cloud storage services (AWS S3, Google Cloud Storage) typically store it under a UUID-based filename to prevent collisions and avoid exposing original filenames.

API Request IDs

Many APIs assign a UUID to each request for traceability. If an API call fails, you provide the request UUID to support for investigation across distributed logs.

Session Tokens

Web server session IDs are often UUIDs — though for security-sensitive tokens, a cryptographically secure random string of similar length is preferred.

Generating a UUID in Popular Languages

Language	Code
JavaScript (browser)	crypto.randomUUID()
Python	import uuid; str(uuid.uuid4())
Java	UUID.randomUUID().toString()
PHP	Str::uuid() (Laravel) or ramsey/uuid
Go	github.com/google/uuid package