Which kind should I use?
| UUID v4 | UUID v7 | ULID | |
|---|---|---|---|
| Content | 122 random bits | 48-bit ms timestamp + 74 random bits | 48-bit ms timestamp + 80 random bits |
| Sortable by time | No | Yes | Yes |
| Text form | 8-4-4-4-12 hex | 8-4-4-4-12 hex | 26 chars Crockford Base32 |
| Standard | RFC 4122 / 9562 | RFC 9562 (2024) | Community spec |
| Database friendliness | Poor as a primary key: random inserts fragment B-tree indexes | Good: new rows land at the end of the index | Good, but needs a 128-bit column or 26-char string |
For a new system, UUID v7 is the sensible default: it is a standard UUID, every database and language accepts it, and it keeps indexes compact. Use v4 when the ID must not reveal when it was created. ULID is a fine choice where its shorter, URL-friendly text form matters and the ecosystem already uses it.
Reading the bits
In xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx, the digit M is the version (4 or 7) and the first bits of N are the variant (8, 9, a or b for standard UUIDs). In a v7 the first 12 hex digits are the Unix time in milliseconds; in a v1 the time is scattered across three fields and the last 12 digits are usually the MAC address of the machine that made it. The inspector decodes all of this.
Collisions
A v4 UUID has 2¹²² possibilities. To reach a 50% chance of a single collision you would need to generate about 2.7 × 10¹⁸ of them, roughly a billion per second for 85 years. In practice the risk is a bad random source, not the maths, which is why this page uses crypto.getRandomValues and not Math.random.
Questions
What is the difference between UUID and GUID?
None in practice. GUID is Microsoft's name for the same 128-bit identifier. Windows tools often write them in upper case with braces, which the format option here reproduces.
Are these UUIDs truly random?
The random bits come from the browser's cryptographically secure generator (WebCrypto), the same source used for keys. They are not derived from your clock or anything predictable, except that v7 and ULID deliberately include the current time.
Can a UUID be traced back to me?
A v4 cannot. A v7 or ULID reveals when it was created. A v1 may contain the MAC address of the generating machine, which is why v1 fell out of favour.
Should I use a UUID as a database primary key?
Yes if you need IDs generated by clients or across services, but prefer v7 so inserts are sequential. Store it in a native 16-byte UUID column (PostgreSQL uuid, MySQL BINARY(16)) rather than a 36-character string.
What is the nil UUID?
00000000-0000-0000-0000-000000000000, defined as a placeholder meaning “no value”. RFC 9562 also defines a max UUID of all ones.