Understand this tool
Use UUIDs as identifiers, not secrets
- What the concept means
- A UUID is a 128-bit identifier formatted for extremely low collision probability without a central issuing database.
- Why it exists
- It lets distributed systems create identifiers independently and later combine records with little risk of accidental duplication.
- When to use it
- Use UUIDs for identifiers, correlation values, and database keys when their size and indexing behavior are acceptable.
- What the result means—and does not mean
- Uniqueness is probabilistic or construction-dependent, not magical. A UUID is public identifier material, not a password, authorization credential, or unpredictable security token.
From Apollo and DCE to RFC 9562
UUID ancestry includes identifiers developed for Apollo Network Computing System and later the Open Software Foundation’s Distributed Computing Environment. Internet specifications standardized compatible layouts; RFC 9562 replaced RFC 4122 in 2024 and defines current versions and variants.
A UUID contains version and variant bits that describe layout. Version 4 fills the remaining 122 bits with random or pseudorandom data. Versions 1 and 6 are time-based, version 7 is Unix-time ordered, and name-based versions derive values from a namespace and name.
Collision probability and security
With uniformly random version-4 UUIDs, collisions remain extremely unlikely at ordinary scales because the available space is enormous. Probability is not zero, and poor random sources can invalidate the assumption. Random-looking identifiers should not be treated as secrets.
Key concepts
Key concepts
- UUID
- A 128-bit universally unique identifier.
- Version
- Bits identifying the UUID generation layout.
- Variant
- Bits identifying the UUID layout family.
- UUID version 4
- A layout with 122 random bits after fixed version and variant bits.
- Collision
- Two generated identifiers having the same value.
- DCE
- The Distributed Computing Environment that helped establish UUID use.
Method or process
How the process works
Collision probability and security
With uniformly random version-4 UUIDs, collisions remain extremely unlikely at ordinary scales because the available space is enormous. Probability is not zero, and poor random sources can invalidate the assumption. Random-looking identifiers should not be treated as secrets.
Compare the concepts
Common UUID versions
| Version | Primary input | Property |
|---|---|---|
| v4 | Random bits | No time ordering |
| v7 | Unix time plus random bits | Roughly time ordered |
| v5 | Namespace and name | Deterministic |
Common mistakes
Common mistakes
- Using a UUID as an authentication secret.
- Assuming every UUID is random.
- Removing uniqueness constraints because collisions are unlikely.
Edge cases and limits
Edge cases and limits
- A broken random source raises collision risk.
- Some databases index random UUIDs less efficiently than ordered identifiers.