Understanding RFC 4122 Universally Unique Identifiers (UUID)
A Universally Unique Identifier (UUID), historically called a Globally Unique Identifier (GUID) in Windows environments, is a 128-bit numerical label designed to guarantee uniqueness across distributed computing architectures without central coordinator registration. Formatted as 32 hexadecimal characters divided into five groups separated by hyphens (8-4-4-4-12), UUIDs power distributed database primary keys, asynchronous job queues, telemetry traces, and idempotent API requests.
Version 4: CSPRNG Randomness
UUID v4 is the most common format, dedicating 122 bits to pure pseudorandomness and 6 bits to version and variant flags. Generated via the Web Crypto API, it provides cryptographic resilience against collision and predictability.
Version 1: 100-Nanosecond Timestamps
UUID v1 combines a 60-bit timestamp (measured in 100-nanosecond intervals since the Gregorian calendar reform of October 15, 1582) with a clock sequence and node identifier, providing natural chronological sortability.
UUID Specifications & Architectural Applications
| Version | Basis / Source | Primary Benefit | Standard Usage |
|---|---|---|---|
| UUID v4 | 122 Random Bits | Zero collision risk, completely unguessable | Distributed DB IDs, API keys, OAuth state |
| UUID v1 | Timestamp + Clock | Naturally sortable by creation time | Database primary keys (B-Tree friendly), logging |
| Nil UUID | 128 Zero Bits | Deterministic empty/null placeholder | Default initialization in database schemas |
| UUID v5 / v3 | SHA-1 / MD5 Hash | Deterministic namespaced output | Generating reproducible IDs from URLs or DNS |
Frequently Asked Questions
Are the generated UUIDs cryptographically secure?
Yes. Version 4 UUIDs are produced using the browser's native Web Crypto API (crypto.randomUUID and crypto.getRandomValues), utilizing cryptographically secure pseudorandom number generators (CSPRNG) rather than pseudo-random functions like Math.random().
What is the structural difference between a UUID and a GUID?
Technically, GUID (Globally Unique Identifier) is Microsoft's implementation of the standardized UUID (Universally Unique Identifier) defined by RFC 4122. Both are 128-bit integers formatted as 32 hexadecimal digits separated by four hyphens (8-4-4-4-12).
What is the likelihood of a UUID v4 collision?
A UUID v4 contains 122 bits of pure randomness, giving 2122 (approximately 5.3 × 1036) unique values. The probability of generating two identical UUIDs is practically negligible, even when generating billions per second across distributed databases.
Are the generated UUIDs logged or stored on your servers?
No. Every identifier is computed locally inside your web browser using client-side JavaScript. No identifiers are sent over the network or saved to databases.