What Is a UUID?
A UUID (Universally Unique Identifier), often called a GUID in Microsoft ecosystems, is a 128-bit value used to identify records, objects, transactions, and resources without coordinating with one central counter. The current UUID specification is RFC 9562, which replaced RFC 4122. Canonical text uses 32 hexadecimal digits in five hyphen-separated groups: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.
UUIDv4 fills 122 bits with cryptographically strong random or pseudorandom data; the remaining six bits identify the version and variant. That creates approximately 5.3 × 10³⁶ possible UUIDv4 values. Collisions are extremely unlikely at ordinary application scale, but UUIDs do not provide a mathematical uniqueness guarantee.
UUID vs GUID — Are They the Same?
UUID (Universally Unique Identifier)
- Industry-standard term currently defined by RFC 9562
- Used in Linux, macOS, web standards, IETF protocols
- Standard across databases: PostgreSQL, MySQL, SQLite
- Used in AWS resource ARNs, GCP, Kubernetes
GUID (Globally Unique Identifier)
- Microsoft's terminology for the same 128-bit identifier
- Used in Windows, .NET, COM/ActiveX, Azure services
- Usually uses the same canonical text representation as UUID
- SQL Server uses UNIQUEIDENTIFIER data type for GUIDs
Bottom line: UUID and GUID are normally interchangeable in their canonical text form. Some Microsoft binary serialization formats use a different byte order for selected fields, so check the target API when passing raw 16-byte values instead of text.
UUID v4 Anatomy
550e8400-e29b-41d4-a716-446655440000
Random bits
122 bits of cryptographically random data
Version (4)
Third segment always starts with '4' — identifies UUIDv4
Variant (8, 9, a, b)
Fourth segment starts with 8/9/a/b — RFC 4122 variant bit
Common UUID Use Cases
Database Primary Keys
Distributed unique IDs for PostgreSQL, MySQL, MongoDB rows.
REST API Request IDs
Trace and correlate HTTP requests across microservices.
Microservice Correlation IDs
Link logs, spans, and events across distributed systems.
Public Object Identifiers
Non-secret identifiers for records, objects, and application resources.
File Tracking Systems
Unique identifiers for uploads, assets, and documents.
Distributed Event Processing
Idempotency keys for queues and event sourcing systems.
Cloud Resource IDs
Resource naming in AWS, GCP, Azure, and Kubernetes.
IoT Device Registration
Globally unique device identifiers for IoT fleets.
UUIDs Are Identifiers, Not Secrets
Good uses
Database keys, request IDs, event IDs, idempotency keys, object identifiers, and test fixtures.
Do not use as
Passwords, API keys, bearer tokens, reset links, encryption keys, or proof that a user is authorized.
Why
A UUID can be copied, logged, indexed, or exposed in a URL. Randomness alone does not add authentication, expiration, or permissions.
Continue Your Developer Workflow
Place generated identifiers into structured data with the JSON Formatter & Validator, encode a UUID or URN for a query string using the URL Encoder & Decoder, calculate file or text fingerprints with the Hash Generator, or inspect identifier claims inside a JWT Decoder.
UUID Format and Browser API References
UUID versions, variants, canonical text, Nil UUID, Max UUID, and UUIDv4 generation are defined by RFC 9562. Browser UUIDv4 generation is documented by MDN's Crypto.randomUUID reference. External references open in a new tab.