What Is a UUID? v4 vs v7 Explained

UUIDs are everywhere — database keys, request IDs, file names — but they're often used without much thought about which kind to pick. The choice between v4 and v7 actually matters for performance. Here's what you need to know.

What is a UUID?

A UUID (Universally Unique Identifier), also called a GUID, is a 128-bit value usually written as 32 hex digits in the pattern xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Its purpose is to let any system generate an identifier without coordinating with anything else, and be confident it won't clash with one generated elsewhere. That property makes UUIDs ideal for distributed systems, where a central counter would be a bottleneck.

Are collisions a real risk?

In practice, no. A random (v4) UUID has 122 bits of randomness. You would need to generate on the order of a billion billion UUIDs before a collision became even remotely likely — far more than any real system produces. You can safely treat them as unique. (Note: "unique" is not the same as "unguessable" — see below.)

UUID v4: random

Version 4 is the one most people know: almost entirely random. It's simple, unpredictable, and great as a general-purpose identifier. Its one weakness shows up when you use it as a database primary key: because the values are scattered randomly, new rows insert at random points in the index, which fragments it and hurts write performance on large tables.

UUID v7: time-ordered

Version 7 (standardised in RFC 9562) fixes that. It puts a millisecond timestamp in the high bits, so v7 UUIDs generated later sort after earlier ones. They're still globally unique and unpredictable in their random portion, but because they're roughly ordered, they insert neatly at the end of a database index — keeping it compact and writes fast. For new primary keys, v7 is increasingly the recommended choice.

Rule of thumb: use v7 for database keys where insert order and index performance matter, and v4 when you just want a random identifier with no embedded timestamp.

A UUID is not a secret

One important caveat: UUIDs are designed to be unique, not unguessable in the security sense. Don't use one as a password, session token or access key — for that you want explicit, high-entropy randomness from a dedicated API key generator. A v7 UUID in particular leaks its creation time, which is fine for an ID but not for a secret.

UUID vs GUID

They're the same thing. GUID (Globally Unique Identifier) is Microsoft's name for a UUID; both are 128-bit identifiers in the same format. Don't let the two terms confuse you.

Try it

Generate v4 or v7 UUIDs in bulk with our UUID generator and compare how v7's leading timestamp keeps a batch in order. For secrets rather than identifiers, use the API key generator.