UUIDs Explained: When to Use Unique Identifiers
A UUID (Universally Unique Identifier) is a 128-bit value used to label things such as database records, files and sessions without needing a central authority to hand out numbers.
What it looks like
A UUID is written as 32 hexadecimal digits in five groups: 123e4567-e89b-12d3-a456-426614174000. The format is standardised in RFC 4122 and its updates.
Versions in plain words
- Version 1: based on a timestamp and the machine's identifier. Can leak when and where it was created.
- Version 4: generated from random numbers. This is the most common and what most online generators produce.
- Version 5 (and 3): derived from hashing a namespace and a name, so the same inputs always yield the same UUID.
- Version 7: a newer design that puts a timestamp at the start and random bits after, so IDs sort roughly in creation order, which is friendlier to databases.
Why collisions are not a worry
A version 4 UUID has 122 random bits. The number of possible values is about 5.3 × 10^36. Even if you generated a billion UUIDs per second for decades, the chance of two matching would still be vanishingly small. The caveat is the quality of the random number generator: use a cryptographically secure source.
Advantages over auto-increment IDs
- Create IDs anywhere. Clients, services or offline apps can generate them without asking the database.
- Easier merging of data from different systems.
- Harder to guess. Sequential IDs allow people to enumerate records (
/invoice/101,/invoice/102). Random UUIDs do not, though you must still enforce access control.
Disadvantages
- Size: 16 bytes (or 36 characters as text) versus 4 or 8 bytes for integers.
- Index performance: completely random IDs scatter inserts across a database index, which can slow writes on very large tables. Time-ordered UUIDs (version 7) reduce this.
- Readability: they are hard to type or read out loud.
Best practices
- Store UUIDs in your database's native UUID or binary type rather than text, when available.
- Do not treat a UUID as a secret. An unguessable ID is not a replacement for authorisation checks.
- Do not put sensitive information in version 1 or 5 UUIDs.
- Choose one format (lowercase with hyphens is common) and use it everywhere.
Practical uses
Order numbers, file names for uploads, idempotency keys for API requests, correlation IDs in logs, and primary keys in distributed systems.
Short alternatives
If a 36-character ID is too long for URLs, consider shorter random identifiers or Base62 encodings. Check that the collision risk is acceptable for your scale.
Use UUIDs where independence and uniqueness matter, and keep authorisation separate from identifiers.
