What UUIDs are for
A UUID (Universally Unique Identifier), also called a GUID in Microsoft ecosystems, is a 128-bit value written in a standard textual form such as:
550e8400-e29b-41d4-a716-446655440000
Systems use UUIDs when they need identifiers that are extremely unlikely to collide without a central allocator: database primary keys in distributed services, message IDs, upload handles, and resource names in APIs. Uniqueness is probabilistic (or derived from names) rather than proven by a global registry lookup each time you mint an ID.
Generate a sample with Generate UUID, then check formatting and version fields with Validate UUID.
Subtools in this family
- Generate UUID — creates UUIDs in versions 1, 3, 4, or 5, with optional namespace and name inputs where those versions require them.
- Validate UUID — verifies that a string matches UUID layout and reports validity considerations for versions 1 through 5.
Generation and validation are complementary: mint IDs in the version your schema expects, then validate user-supplied or imported strings before accepting them as foreign keys or cache keys.
Versions you will actually meet
Version 4 (random). The most common choice for new application IDs. Most bits are random from a CSPRNG; version and variant bits are fixed per RFC 4122. Collisions are negligible for practical volumes when the generator is sound.
Version 1 (time-based). Embeds a timestamp and node identifier (historically a MAC address). Useful when you want rough time ordering, but it can leak creation time and machine identity—privacy-sensitive contexts often prefer v4 or newer schemes.
Version 3 (MD5 name-based) and version 5 (SHA-1 name-based). Derive a UUID from a namespace UUID plus a name string. The same namespace+name always yields the same UUID—handy for stable IDs from URLs or usernames without storing a lookup table. v5 is preferred over v3 for new designs because it uses SHA-1 instead of MD5 in the derivation.
Other versions and successor proposals (for example time-sortable UUIDv7 in newer RFCs) appear in modern stacks; when your platform documents a specific version, match it rather than inventing a mix.
Text format and variant bits
Canonical text uses five hex groups 8-4-4-4-12. Parsers should accept uppercase or lowercase hex. The version nibble sits in the third group; the variant bits sit in the fourth. Validation that only checks “looks like hex with hyphens” is weaker than validation that also checks version/variant consistency for the claimed type.
Some APIs accept URN form (urn:uuid:…) or brace-wrapped GUIDs {…}. Normalize before compare. Binary storage is 16 bytes; text form is for humans and JSON.
Choosing IDs wisely
When UUIDs help. Merge-friendly primary keys, offline ID minting, hiding sequential row counts from clients.
When they hurt. Huge random primary keys can fragment B-tree indexes compared with sequential integers—measure for your database. Logging and support become harder if every ID is opaque; pair with human-facing case numbers when operators need them.
Stability. For name-based v3/v5, document the namespace UUID your organization standardizes on (DNS, URL, OID, or a custom root). Changing the namespace silently remints a different ID for the same name.
Security notes
UUIDv4 values are identifiers, not authentication secrets. Still, guessing a v4 ID is hard if it is unlisted—do not treat that as authorization by itself; always enforce access control. Avoid v1 if MAC-derived node bits would reveal hardware identity on public documents. Do not embed passwords or PANs inside name strings for v3/v5.
Common mistakes
- Generating v4 but storing only the first half “to save space,” destroying uniqueness guarantees.
- Case-sensitive string compares across systems that normalize differently.
- Using nil UUID (
00000000-0000-0000-0000-000000000000) as a real entity key. - Assuming validation of format implies the ID exists in your database.
- Mixing multiple generators with different version policies for the same column.
Limitations and environment
These tools help you mint and inspect RFC-style UUIDs in the browser for development and education. They do not allocate IDs from your production database sequences or guarantee global uniqueness across broken RNGs.
Summary
UUIDs provide 128-bit identifiers in a standard hex form, with versions for random, time-based, and name-based generation. This hub pairs a multi-version generator with a validator so you can create IDs that match your schema and reject malformed strings early. Prefer v4 for general use, v5 for stable name-derived IDs, and always enforce authorization separately from identifier opacity.