UUIDs

The format predates the web. In the early 1980s Apollo Computer needed identifiers that any machine on a network could mint without asking a central authority, and built 64-bit unique IDs into its Domain/OS. The idea moved into Apollo's Network Computing System, widened to 128 bits, and from there into the Open Software Foundation's Distributed Computing Environment RPC specification at the start of the 1990s. Microsoft adopted the DCE design for COM and called the result a GUID — the same sixteen bytes, but historically printed with the first three fields byte-swapped, which is why one identifier can appear in two different spellings.

Paul Leach, Michael Mealling and Rich Salz finally wrote the format down for the IETF in July 2005 as RFC 4122, which registered the urn:uuid namespace and defined five versions: time-and-MAC (1), DCE Security (2), MD5 name-based (3), random (4) and SHA-1 name-based (5). ISO and the ITU standardised the same object as ISO/IEC 9834-8 and ITU-T X.667. Version 1's embedded MAC address turned out to be a privacy leak — GUIDs written into Microsoft Office documents carried the author's network card address, and this is widely reported to have helped investigators identify the author of the 1999 Melissa macro virus, though the accounts are second-hand.

Version 4 won on simplicity and then lost on database performance: random keys scatter inserts across a B-tree index instead of landing at its right-hand edge. Developers built time-ordered alternatives of their own — MongoDB's ObjectId in 2009, Twitter's Snowflake in 2010, Alizain Feerasta's ULID in 2016. A draft by Brad Peabody and Kyzer Davis folded that lesson back into the standard, and in May 2024 RFC 9562 replaced RFC 4122, adding version 6, version 7 (48 bits of Unix milliseconds followed by randomness, so the lowercase text form sorts by creation time) and version 8 for custom layouts.

Key properties

• The canonical text form is 36 characters: 32 hexadecimal digits in groups of 8-4-4-4-12 separated by four hyphens.
• A version 4 UUID carries 122 random bits — 128 minus 4 version bits and 2 variant bits — giving 2^122 ≈ 5.3 × 10^36 possible values.
• The version is the first hex digit of the third group; the variant occupies the top bits of the first hex digit of the fourth group, which for RFC 4122 and RFC 9562 UUIDs is 8, 9, a or b.
• Drawing 103 trillion random version 4 UUIDs gives roughly a one-in-a-billion chance that two of them are identical, by the birthday approximation n²/2N.
• A version 7 UUID begins with a 48-bit big-endian count of milliseconds since the Unix epoch, so sorting the lowercase text form sorts by creation time.
• The nil UUID is all 128 bits zero; RFC 9562 also defines a Max UUID with all 128 bits set.
• RFC 9562 (May 2024) obsoletes RFC 4122 (July 2005) and adds versions 6, 7 and 8 to the original five.
• The UUIDs on this page are produced by a seeded, non-cryptographic PRNG and are reproducible by anyone with the link, so they are deliberately unsuitable as real identifiers.

Where they turn up

• Windows stores COM class and interface identifiers as braced GUIDs in the registry, which is where the {8-4-4-4-12} spelling comes from.
• Linux labels filesystems by UUID — the identifiers in /etc/fstab and the GPT partition table — so disks can be mounted regardless of the order the kernel enumerated them in.
• Databases use UUIDs as primary keys when many clients must mint identifiers without coordinating; version 7 exists mainly because its time ordering keeps B-tree inserts near the right-hand edge of the index.
• Distributed tracing systems use UUIDs as request and span identifiers so that log lines from different services can be stitched back together.
• Apple exposes UUIDs through NSUUID and uses one as the identifier-for-vendor that an app sees in place of a device serial number.
• A version 4 UUID is only as unique as the random source behind it: libraries that have backed one with a weak or predictable generator have produced real collisions, which is a property of the implementation rather than of the format.