What Is a UUID? GUIDs Explained for Developers

Open any database, API response, or log file and you will run into strings like 550e8400-e29b-41d4-a716-446655440000. That is a UUID — a Universally Unique Identifier — and it is one of the most widely used data types in software. This guide explains what those 36 characters actually encode, why two machines on opposite sides of the world can generate IDs at the same moment without ever colliding, and why Microsoft calls the same thing a GUID.

A UUID Is Just 128 Bits

Underneath the familiar text form, a UUID is simply a 128-bit number — 16 bytes. That is it. The dashes and hex digits are only a human-friendly way of writing those bytes. 128 bits gives 2^128 possible values, which is roughly 3.4 × 10^38 — a number so large that if every person on Earth generated a billion UUIDs every second, it would take longer than the age of the universe to run out.

The canonical text representation encodes those 16 bytes as 32 hexadecimal digits in five hyphen-separated groups — the 8-4-4-4-12 pattern:

550e8400-e29b-41d4-a716-446655440000
\______/ \__/ \__/ \__/ \__________/
 8 hex    4    4    4      12 hex
(32 hex digits + 4 hyphens = 36 characters, 16 bytes of data)

By convention UUIDs are written in lowercase, and comparisons should be case-insensitive. The hyphens are purely cosmetic — many systems store UUIDs as raw 16-byte values and only add the dashes when displaying them.

The Hidden Structure: Version and Variant Bits

A UUID is not 128 fully free bits. The RFC reserves a few bits as metadata that describe how the UUID was made:

• Version (4 bits) — the first hex digit of the third group. It tells you the generation algorithm: 1 (timestamp + MAC), 4 (random), 5 (name-based SHA-1), 7 (time-ordered), and so on.
• Variant (2-3 bits) — the first hex digit of the fourth group. For standard RFC UUIDs this digit is always 8, 9, a, or b.

550e8400-e29b-41d4-a716-446655440000
              ^    ^
              |    variant digit (8, 9, a, or b)
              version digit (this is a version 4 UUID)

This means you can read useful information off any UUID at a glance. If the third group starts with 4, it was randomly generated; if it starts with 1, it encodes a timestamp and (historically) the network card's MAC address; if it starts with 7, it is a modern time-ordered UUID. For a random v4 UUID, after subtracting the 6 fixed metadata bits, 122 bits of pure randomness remain.

Why "Universally" Unique?

The magic of UUIDs is decentralised generation. An auto-increment ID is only unique because one database hands out numbers one at a time — a central authority. UUIDs flip that model: any machine, process, or browser tab can mint an ID independently, with no coordination, no network call, and no shared counter, and still be effectively certain no one else has ever produced the same value.

That works because the space of possible values is astronomically larger than the number of IDs humanity will ever generate. For version 4, the chance that any two of a billion randomly generated UUIDs collide is on the order of 10^-19 — far below the probability of hardware failure corrupting your data instead.

"Universally unique" is therefore a statistical statement, not a mathematical guarantee — but the statistics are so lopsided that every major platform, from Linux to Postgres to your browser's crypto.randomUUID(), treats collisions as impossible in practice.

UUID vs GUID: Two Names, One Thing

GUID (Globally Unique Identifier) is Microsoft's name for the same 128-bit identifier. You will see "GUID" in Windows APIs, COM, the .NET System.Guid type, SQL Server's uniqueidentifier column type, and Active Directory. Everywhere else — RFC 9562, Java, Python, PostgreSQL, JavaScript — the term is UUID.

• The binary layout and text format are identical.
• One historical quirk: Microsoft stores some GUID fields in little-endian byte order internally, but the string form is the same 8-4-4-4-12 pattern.
• In conversation, use whichever term your ecosystem uses — they are interchangeable.

Where UUIDs Are Used

• Database primary keys — especially in distributed systems where multiple services insert rows without a central sequence
• API resource IDs — /orders/550e8400-... does not leak how many orders exist, unlike /orders/1042
• Request tracing — correlation IDs that follow a request across microservices and logs
• File and object names — S3 keys, uploaded file names, temp files that must never clash
• Message deduplication — idempotency keys in payment APIs and message queues
• Device and installation IDs — mobile apps identifying an install without personal data
• Bluetooth and hardware — BLE service and characteristic identifiers are UUIDs

If you want to see UUIDs generated live — and inspect their version and variant digits yourself — the free UUID generator creates them instantly in your browser.

Frequently Asked Questions