What Is UUID v4? Random UUIDs Explained

Anatomy of a Version 4 UUID

9b2c1f7e-5d3a-4c8b-a1e2-7f6d0c9b3a54
              ^    ^
              |    variant: 8, 9, a or b
              version: always 4

• The 13th hex digit (first digit of the third group) is always 4.
• The 17th hex digit (first digit of the fourth group) is 8, 9, a or b, which encodes the variant defined by RFC 9562.
• Everything else is random.

UUID format explained covers the layout shared by all versions.

How UUID v4 Is Generated

A generator fills 16 bytes with random data, then overwrites the version and variant bits:

const bytes = crypto.getRandomValues(new Uint8Array(16));
bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4
bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant 10xx

You rarely need to write this yourself. Built-in functions do it correctly: crypto.randomUUID() in browsers and Node.js, uuid.uuid4() in Python, UUID.randomUUID() in Java, Guid.NewGuid() in .NET and gen_random_uuid() in PostgreSQL. How to generate a UUID in JavaScript and in Python have examples.

The quality of the randomness matters. RFC 9562 recommends a cryptographically secure random source; generators built on weak randomness such as Math.random() are more likely to repeat.

How Unique Is It?

With 122 random bits there are about 5.3 × 10^36 possible v4 UUIDs. The chance of two properly generated values colliding is so small that it isn't a practical concern for almost any application. The UUID collision probability works through the numbers.

When to Use UUID v4

Good uses:

• IDs for records, files, messages and events
• Correlation IDs for tracing requests through logs
• Idempotency keys in APIs
• Public identifiers that shouldn't reveal record counts or creation times

Less ideal:

• Clustered database keys on very large tables, where random inserts fragment indexes; UUID v7 is time-ordered and often better. See UUID v4 vs UUID v7.
• Secrets, such as password reset tokens or API keys. A v4 UUID has fewer random bits than a dedicated 256-bit token, its format is recognisable, and some generators aren't cryptographically secure. Use your platform's secure token generator.
• Human-facing codes that people must read or type.

How to Tell If a UUID Is Version 4

Look at the 13th hex digit. If it's 4 and the 17th is 8–b, it's a standard version 4 UUID. The UUID validator checks this for you and shows the version and variant, and the UUID decoder confirms that a v4 value contains no timestamp to extract.

Generating Version 4 UUIDs

The UUID v4 generator creates random version 4 UUIDs in your browser using the Web Crypto API, one at a time or up to 1,000 at once, in lowercase or uppercase, with or without hyphens. Copy them or download them as a file for test data and fixtures.

Common Misconceptions

• "UUIDs are guaranteed unique." They're unique with overwhelming probability, not by guarantee. That's good enough for nearly every system, but unique constraints are still wise.
• "A UUID is a security token." Unpredictability isn't the design goal, and some generators aren't cryptographically secure.
• "Removing hyphens makes it a different ID." Hyphens are formatting; the 128-bit value is the same.
• "Uppercase UUIDs are invalid." Both cases are allowed; lowercase is the canonical output.
• "All GUIDs are version 4." GUIDs can be any version, though .NET's Guid.NewGuid() produces v4.

Storage Tips

Store UUIDs in native types where possible: uuid in PostgreSQL, uniqueidentifier in SQL Server, BINARY(16) in MySQL (with conversion functions). A native type uses 16 bytes, compared with 36 bytes or more for text, and makes comparisons and indexes faster.

Summary

UUID v4 is 122 random bits plus version and variant markers, written as 8-4-4-4-12 hex digits. It's simple, private and practically collision-free, but use v7 for index-friendly keys and dedicated tokens for secrets.