What Is a UUID?
A UUID (universally unique identifier) is a 128-bit number used to label a record, file, user or
request without needing a central counter. It is normally written as 32 hexadecimal digits in five
groups, 8-4-4-4-12, and the 13th digit shows the version. Because any machine can create
one on its own and the chance of a repeat is tiny, UUIDs are common as database keys and in APIs.
GUID is Microsoft's name for the same thing. A GUID from .NET or SQL Server is a UUID, so this page works for both.
UUID v4 vs UUID v7
| v4 | v7 | |
|---|---|---|
| What it contains | Random bits (122 of 128) | A millisecond timestamp, then random bits |
| Sorts by creation time | No | Yes, roughly |
| Reveals when it was made | No | Yes, anyone can read the timestamp |
| Good for | General IDs, test data | Database keys and logs you want in order |
A random v4 value lands anywhere in a database index, while v7 values arrive in order. Many teams choose v7 for primary keys for that reason. The cost is that a v7 UUID shows when it was created, so do not use it where that timestamp should stay private. UUID v7 was added in RFC 9562, published in 2024, which replaced the older RFC 4122.
How This Generator Works
Version 4 values come from the browser's crypto.randomUUID(), or from
crypto.getRandomValues() where that function is missing. Version 7 values put the
current Unix time in milliseconds in the first 48 bits and fill the rest with secure random bits.
When you make several in the same millisecond, a small counter keeps them in order. Nothing is sent
anywhere.
How Unique Is a UUID?
A v4 UUID has 122 random bits, which is about 5.3 × 1036 possible values. By the birthday estimate, you would need about 2.7 quintillion UUIDs before there was a 50 percent chance that any two matched. For ordinary applications, a repeat caused by chance is not a practical worry. A broken random number generator is the real risk, which is why the source of randomness matters.
A UUID Is an ID, Not a Secret
Do not use a UUID as a password, API key or login token. The standard warns against treating UUIDs as security capabilities, and a v7 value even contains its creation time. For passwords use the Strong Password Generator. For API secrets, webhook secrets and hex or Base64URL tokens use the Developer Credential Generator. If you want to see how many bits a value really has, try the Password Entropy Calculator.
Generate a UUID in Your Own Code
Most languages have this built in:
// JavaScript and Node.js (14.17+) crypto.randomUUID() # Python import uuid str(uuid.uuid4()) // Java java.util.UUID.randomUUID().toString() // C# / .NET Guid.NewGuid().ToString() -- SQL Server SELECT NEWID(); -- PostgreSQL (13+) SELECT gen_random_uuid();
Check your database's documentation for v7 support, because it varies by product and version. The generator above is handy for test data, fixtures and quick one-off IDs.