PRACTICAL GUIDE
Are UUIDs Really Unique?
How random a version-4 UUID is, what the collision odds genuinely look like, and the cases where a UUID is the wrong identifier.
Last updated
Uniqueness by improbability, not by bookkeeping
A UUID is a 128-bit value, conventionally written as 32 hexadecimal digits in five hyphen-separated groups. Nothing coordinates their allocation — there is no registry and no central counter. A version-4 UUID is simply random, and its uniqueness rests on the space being large enough that a repeat is not worth worrying about.
Of the 128 bits, six are fixed to record the version and variant, leaving 122 bits of randomness. That is roughly five thousand billion billion billion billion possible values.
The numbers, concretely
The often-quoted figure is that among 103 trillion version-4 UUIDs, the chance of a single duplicate is about one in a billion. Put another way, you would need to generate a billion UUIDs every second for around a century before a collision became roughly as likely as not.
For comparison, the risk that two of your servers both write the same record because of a bug, or that a disk silently corrupts a byte, is enormously higher. UUID collision is not the thing that will break your system.
The real risk is a weak random source
The maths only holds if the bits are genuinely unpredictable. A UUID generated from a poor random number generator — one seeded from the clock, say, or reset identically on every container start — can and does collide, and this is where real-world duplicates come from. Browsers provide crypto.randomUUID, which is required to use a cryptographically secure source; our generator uses it directly rather than assembling one by hand.
Unique does not mean secret
A version-4 UUID from a secure source carries 122 bits of entropy, which is more than enough to be unguessable. But not every UUID is version 4: version 1 encodes a timestamp and historically a network card address, making it predictable and mildly disclosive. Never assume a UUID is unguessable because of its shape — if a value is protecting something, generate it as a token deliberately rather than inheriting the assumption.
Where UUIDs are the wrong choice
As a clustered primary key in a large relational table, random UUIDs scatter inserts across the index instead of appending to the end, which fragments it and hurts write performance. Time-ordered identifiers — version 7, or a sortable scheme of your own — keep the sequential locality while remaining globally unique.
In user-facing places, too. They are 36 characters, impossible to read aloud, and easy to transcribe wrongly. A short human-friendly code, with a UUID underneath, is kinder to everyone.
Format details that catch people out
UUIDs are case-insensitive, so a system that compares them as strings must normalise first — this is a genuinely common bug. Some databases and APIs store or emit them without hyphens, and some wrap them in braces. Decide on one canonical form at your system boundary and convert everything to it on the way in.
Frequently asked questions
Do I need to check the database for duplicates before inserting a UUID?
A unique constraint on the column is sensible defensive practice, and it costs nothing. A read before every write to check for collisions is not worth the round trip against odds like these.
Is a UUID safe to use as a password reset token?
A version-4 UUID from a cryptographically secure generator has enough entropy for the job, but relying on it means relying on the specific implementation. Generating a dedicated random token makes the security property explicit rather than incidental — and the token still needs an expiry and single use.
What is the difference between UUID and GUID?
None in practice. GUID is Microsoft's name for the same 128-bit identifier, and the two terms are used interchangeably. Microsoft tooling tends to display them wrapped in braces.
Why do all version-4 UUIDs have a 4 in the same place?
That digit is the version field, and the first character of the fourth group encodes the variant — which is why it is always 8, 9, a or b in the common variant. Those are the six fixed bits, and they are the reason a v4 UUID has 122 random bits rather than 128.