Understanding UUID Versions and When to Use Each One

If you've ever generated a UUID and wondered what all those numbers mean - you're not alone. UUIDs (Universally Unique Identifiers) look like random strings, but there's real structure behind them. Understanding that structure helps you choose the right version for your system.

What is a UUID?

A UUID is a 128-bit identifier written as 32 hexadecimal digits separated by hyphens: f47ac10b-58cc-4372-a567-0e02e2d5f6b1. There are 2¹²⁸ possible UUIDs - enough to assign one to every atom in the human body and still have plenty left over.

The format is standardized as RFC 9562. There are several versions, each generated differently and serving different purposes.

UUID v1 - Time + Node

// Version 1: timestamp + node ID
// Example: 6ba7b810-9dad-11d1-80b4-00c04fd430c8

UUID v1 combines:

• A 60-bit timestamp (UTC timestamp in 100-nanosecond intervals since October 1582)
• A 14-bit clock sequence (to handle clock drift)
• A 48-bit node identifier (which may be a MAC address or randomized)

Strengths:

• Carries a timestamp, though its field order does not guarantee lexical time ordering
• Can be generated without a central coordinator

Weaknesses:

• Can expose a MAC address if the generator uses one as the node ID
• Reveals approximately when and where a UUID was created
• Clock sequence handling adds complexity

When to use: Existing systems that require v1 compatibility. Do not assume its string form sorts by creation time.

UUID v4 - Random

// Version 4: cryptographically random
// Example: f47ac10b-58cc-4372-a567-0e02e2d5f6b1

UUID v4 is generated using a cryptographically strong random number generator. 122 of the 128 bits are random; 6 bits are fixed to indicate the version (4) and variant.

Strengths:

• True randomness - no information about the generator is leaked
• No coordination needed between machines
• Simple to generate

Weaknesses:

• Not time-ordered - new rows get "random" positions in indexes
• ~122 bits of entropy sounds like a lot but some implementations have weak RNGs (always use crypto.randomUUID() in Node.js or crypto.getRandomValues() in browsers)
• Sequential inserts are random I/O for rotating storage

When to use: Default choice for most new systems. Default for PostgreSQL (gen_random_uuid()), JavaScript (crypto.randomUUID()), Python (uuid.uuid4()). Works well when you don't need to infer anything from the ID itself.

UUID v5 - Name-based with SHA-1

// Version 5: namespace + name, hashed with SHA-1
// Pseudocode: use a UUID v5 library that accepts a namespace and name.
const namespace = '6ba7b811-9dad-11d1-80b4-00c04fd430c8';
const name = 'https://toolblip.com/user/123';
// uuidV5(namespace, name) returns the same ID for this pair every time.

UUID v5 is generated by hashing a namespace identifier (UUID) and a name using SHA-1. The same namespace + name always produces the same UUID.

Strengths:

• Deterministic - reproducible across systems
• No networking required (unlike v1)
• Namespaced - you can define your own namespaces and avoid collisions

Weaknesses:

• Not sortable
• SHA-1 is considered cryptographically weakened (though still fine for non-security uses)

When to use: Generating stable IDs for external resources (webhooks, OAuth subject identifiers, content-addressable storage). If you need the same ID for the same input every time, v5 is the answer.

UUID v7 - Time-ordered (New Standard)

// Version 7: unix timestamp + random bits (recommended for most use cases)
// Example: 0191a1e0-9e3b-7f3a-a567-0e02e2d5f6b1

UUID v7 is defined in RFC 9562, published in 2024:

• First 48 bits: Unix timestamp in milliseconds
• Then version and variant bits
• The remaining 74 bits are random, with optional counter or sub-millisecond fields for monotonicity

Strengths:

• Time-ordered - sorts by generation time
• No node ID field, though the timestamp reveals approximate creation time
• URL-safe (no special characters)
• Timestamp prefix can improve insert locality compared with random v4 IDs

Weaknesses:

• Relatively new - not all languages/frameworks have native support yet
• Requires a good entropy source for the random bits

When to use: New projects where timestamp ordering helps. Check your database and runtime documentation for current generator support; strict same-millisecond ordering needs an appropriate generator.

Quick Comparison

Version	Time-ordered	Privacy	Deterministic	Notes
v1	Timestamp, not lexical sort	Node dependent	No	Node ID may be randomized
v4	No	Yes (random)	No	Default choice for most cases
v5	No	Yes (hashed)	Yes	Good for stable external IDs
v7	Timestamp prefix	Timestamp visible	No	Same-ms order depends on generator

A Note on UUID Collisions

For v4, 122 bits vary. For n independent values, the birthday approximation is p ≈ n(n−1) / (2 × 2^122) while p is small. For one million generated IDs, that is about 9.4 × 10^-26. The estimate assumes a sound random generator and a stated total sample count.

Practical Recommendations

For most new work - UUID v4. It's the default in most frameworks, requires no thought, and works well.

For database primary keys where insert locality matters - UUID v7. The timestamp prefix can improve insert locality; actual performance depends on the database and index. Check the version of your database for generator support.

For generating IDs from external strings - UUID v5. OAuth subject identifiers, content hashes, GitHub-style stable IDs for external resources.

For legacy systems or distributed databases that benefit from time-ordering - UUID v1. Rarely needed in new development.

JavaScript Implementation

// Generate a v4 UUID in an environment with Web Crypto
const id = crypto.randomUUID();
console.log(id); // a newly generated UUID v4

// Verify it's valid
const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
console.log(UUID_REGEX.test(id)); // true

Useful Tool

Generate UUIDs instantly in your browser - the generation action runs locally. Try our UUID Generator tool.

---

The linked tool generates v4 UUIDs in the browser. It does not generate v1, v5, or v7.