What is a UUID and when should you use one?

A UUID (universally unique identifier) is a 128-bit value written as 32 hexadecimal digits in five groups, like 123e4567-e89b-42d3-a456-426614174000. It is 36 characters long including the hyphens.

Because it can be generated anywhere without checking a central database, it is popular for distributed systems, offline apps and public identifiers.

A version 4 UUID has 122 random bits; the remaining bits record the version and variant. That is why the third group always starts with 4.

The chance of two random UUIDs matching is astronomically small. You would need to generate about a billion per second for roughly 85 years before the odds of a single collision reach 50%.

UUIDs suit database keys that are created in several places, public URLs that should not reveal how many records exist, and request or trace identifiers.

Random UUIDs are larger than integers and do not sort by creation time, which can affect database index performance. Time-ordered formats such as UUID version 7 address this.

A UUID is unique, not necessarily unguessable in every implementation, and it often appears in URLs and logs. Do not rely on it as a password or access token.

Use a cryptographically secure random token of sufficient length for anything that grants access.