UUID: Practical Tips

Collision probability

For independent, uniformly random UUIDv4 values, the probability of at least one duplicate among n values is approximately p ≈ n(n−1) / (2 × 2^122) when p is small. This differs from the probability for just one fixed pair.

Risk by count

Handle duplicates

• Use a database unique constraint to detect duplicates and define regeneration and retry handling. The constraint does not generate IDs.
• Biased randomness or reused values invalidate this model. Truncating the ID reduces the available space.

Time ordering and alternatives

UUIDv7 was standardized in RFC 9562 in May 2024. ULID and KSUID are separate formats, not interchangeable UUID strings.

Size and structure

Check ordering and compatibility

• UUIDv7 normally uses 74 remaining bits for randomness; implementations may use some for sub-millisecond time or counters. Check behavior within one millisecond and after clock rollback.
• ULID does not always preserve generation order within one millisecond; check its monotonic mode. KSUID stores seconds relative to its own epoch.
• Clocks on different machines can disagree. Timestamp-bearing IDs do not prove global processing or database commit order.
• GUID is another name for UUID. For binary interchange, check byte order: some Microsoft formats differ from network byte order.

Representation and storage

A shorter representation need not discard information. Distinguish reversible encoding from truncation.

Normalize representation

• The usual representation has 8-4-4-4-12 hexadecimal digits. Letter case does not change the value. Decide explicitly whether an input accepts unhyphenated strings.
• A UUID URN adds the prefix urn:uuid:. For a custom Base32 or Base64url representation, agree on alphabet, padding, byte order, and preservation of all 128 bits.

Choose storage

• Consider a native UUID type where available, otherwise 16-byte binary or text storage. BINARY(16) is not universally faster; compare actual indexes, comparisons, and queries.
• Some conversion functions rearrange bytes for UUIDv1. Before reusing them with v7, test round trips and ordering.

Privacy and randomness

Knowing an identifier does not establish permission to access its resource.

Understand exposed information

• UUIDv1 includes time and may include a MAC address. A random node value does not hide time. UUIDv7, ULID, and KSUID also carry timestamps.
• Generate random IDs with a library backed by a cryptographically secure random generator. Do not treat a UUID as a secret access capability; enforce authentication and authorization separately.

Input validation

Distinguish a UUID-shaped string from a value accepted by your API.

Define accepted values

• Parse the structure, then check the versions and variants allowed by your API. The version is at the start of the third block. Decide whether Nil and Max are accepted.
• Valid syntax does not establish record existence or access rights. Check storage uniqueness and resource authorization separately.

Generate UUIDv4

Run these in a terminal with Python 3 or a compatible Node.js installed. Use python3 instead of python where required.

Generate with Python

python -c "import uuid; print(uuid.uuid4())"

Generate with Node.js

Use a release supporting crypto.randomUUID. Each run prints a fresh value.

node -e "console.log(require('node:crypto').randomUUID())"

Specifications and related reading

RFC 9562 (§4, §5.4, §5.7, §6, §8) / ULID specification / KSUID reference implementation / Python uuid / Node.js crypto.randomUUID

Related basics

UUID basics / Unix time / Hash values