What Is a UUID? A Practical Guide for Developers

A UUID — Universally Unique Identifier — is a 128-bit value used to label something so that it (essentially) never collides with any other identifier, anywhere, without a central authority handing out numbers. You’ve seen them: strings like f47ac10b-58cc-4372-a567-0e02b2c3d479. This guide explains what they are, why they’re useful, and when to reach for one.

What a UUID looks like

A UUID is written as 32 hexadecimal digits split into five groups by hyphens, in the pattern 8-4-4-4-12:

f47ac10b-58cc-4372-a567-0e02b2c3d479
└──────┘ └──┘ └──┘ └──┘ └──────────┘
   8      4    4    4        12

Generate one (or a batch) with the UUID Generator.

Why not just use 1, 2, 3…?

Sequential IDs work fine in a single database with one source of truth. They break down when:

• Multiple systems create records independently — two servers both assigning “user 1001” is a collision waiting to happen. UUIDs let each system mint IDs with no coordination.
• You need the ID before saving — a client can generate a UUID for a new item offline and sync later, without waiting for the database to assign a number.
• You don’t want to leak information — sequential IDs reveal how many records exist and let people guess neighbours (/orders/1002 → /orders/1003). A UUID gives nothing away.

Version 4: the one you’ll use most

There are several UUID versions, but version 4 is by far the most common. A v4 UUID is almost entirely random — 122 of its 128 bits are random, with the other 6 fixed to mark it as v4. You can spot one by the 4 at the start of the third group and an 8, 9, a, or b at the start of the fourth.

How unlikely is a collision? Astronomically. You would need to generate billions of UUIDs per second for a century before the probability of a single duplicate became meaningful. In practice, treat v4 UUIDs as unique. Toolify’s generator uses your browser’s cryptographically secure random source, so the values are high-quality, not predictable pseudo-random.

When (and when not) to use them

• Great for: primary keys in distributed systems, request/trace IDs in logs, idempotency keys, file names, and anything a client needs to generate itself.
• Think twice for: anything a human must read aloud or type — UUIDs are long and error-prone by hand. And v4 UUIDs are random, so they don’t sort by creation time; if you need time-ordered IDs, look at newer schemes like UUIDv7 or ULIDs.

A common misconception

A UUID is an identifier, not a secret. Because v4 UUIDs are unguessable, people sometimes use them as access tokens (an “unlisted” share link, say). That can be acceptable for low-stakes sharing, but a UUID is not a substitute for real authentication or an access-controlled, expiring token. If something must be protected, protect it properly — don’t rely on the URL being hard to guess.

Need other identifiers or random values? See the Password Generator for secure secrets and the Hash Generator for content fingerprints.