GUID / UUID Wiki - Complete Technical Reference

A practical, developer-friendly wiki about UUID / GUID versions with technical details, security and privacy considerations, standards (RFCs), comparisons, database implications and common pitfalls.

What is a GUID / UUID?

A GUID (Globally Unique Identifier) also called a UUID (Universally Unique Identifier), is a 128-bit identifier standardized by RFC 4122 and RFC 9562. It is designed to be globally unique, meaning no two GUIDs / UUIDs are expected to ever collide. Even when generated on different machines or at large scale.

GUIDs / UUIDs are widely used in databases, APIs, cloud services, distributed systems and software applications where reliable unique identifiers are essential. Their extremely low collision probability allows developers to create unique IDs without relying on a central authority or database lookup. Making them ideal for fast and scalable applications.

Universally Unique IDentifier (UUID) / Globally Unique IDentifier (GUID) - Wikipedia

GUID - Microsoft.com

RFC 4122 - ietf.org

RFC 9562 - ietf.org

VersionTypeDeterministic? Sortable?Secure?Typical UseStandardizedNotes
v1Time + Node (historically MAC)NoYesMAC leak (historically)Distributed systemsRFC 4122
(July 2005)		Includes timestamp + Node (historically the MAC address). Ordered but exposes hardware info.
v2DCE Security (UID/GID)NoPartialLeaks IDsLegacy DCE systemsRFC 4122
(July 2005)		Embeds POSIX UID/GID + MAC address. Rarely supported and considered obsolete.
v3Name (MD5)YesNoMD5Namespace-based IDsRFC 4122
(July 2005)		Deterministic, but MD5 is cryptographically broken.
v4RandomNoNoYesGeneral purpose (Recommended)RFC 4122
(July 2005)		Pure randomness (122 random bits). Extremely low collision probability.
v5Name (SHA-1)YesNoSHA-1Stable API IDsRFC 4122
(July 2005)		Deterministic like v3 but uses SHA-1, which is no longer fully secure.
v6Ordered time v1NoYesYesDatabase indexingRFC 9562
(May 2024)		Improved v1 format with sortable structure + privacy-safe design.
v7Timestamp + randomnessNoYesYesLatest most modernRFC 9562
(May 2024)		Combines millisecond timestamps with strong randomness. Ideal for distributed systems.
v8Custom / User-definedDependsDependsCustomExperimental, app-specificRFC 9562
(May 2024)		Flexible GUID / UUID layout reserved for application-defined use. Not recommended for generic scenarios.
empty-nilEmpty / Nil (all zeros)YesN/ANo (not unique)Sentinel / “no value” / placeholderRFC 4122
RFC 9562		Not a real identifier, used to represent “no value”. Never generate or use it for uniqueness.
Read: GUID/UUID Version 1-8 - The Complete Comparison

GUID vs UUID

UUID is the general term used in standards and documentation. GUID is a term popularized by Microsoft and commonly used in .NET and Windows ecosystems. In practice, they usually refer to the same 128-bit identifier format (with the same canonical string form).

  • UUID: standards terminology (RFCs).
  • GUID: Microsoft terminology; often interchangeable in day-to-day usage.
  • What matters most is the version (v4 vs v7 etc.) and how it behaves (ordering, predictability, privacy).
Read: GUID vs UUID - Are they the same?

When should you use GUIDs / UUIDs?

UUIDs are useful when you need identifiers that can be generated across systems without coordination.

Good fits

  • Distributed systems (multiple services generate IDs)
  • Client-generated IDs (offline / mobile / browser apps)
  • Public IDs (avoid exposing sequential database IDs)
  • Data merges across environments (dev/test/prod)

Consider alternatives when

  • You need minimal storage and maximum locality (auto-increment integers can be faster)
  • You have a single writer and strict ordering requirements
  • You must guarantee monotonic ordering across all generators (needs extra coordination)

Common misconceptions

“GUIDs / UUIDs are always random.”
Not true. Some versions are time-based or name-based. See v5 (name-based) and v7 (time-based).
“GUIDs / UUIDs are secure and unguessable.”
Depends on version and generation method. Random GUIDs / UUIDs can be hard to guess, but GUIDs / UUIDs are not automatically “security tokens”.
“GUIDs / UUIDs are always bad for databases.”
Random ordering can hurt some indexes. But time-ordered GUIDs / UUIDs (like v7) can be much friendlier.

GUIDs / UUIDs and database performance

The biggest practical concern is how GUIDs / UUIDs behave in indexes. Random (unordered) GUIDs / UUIDs can cause poor locality in B-tree indexes, while time-ordered GUIDs / UUIDs often insert more sequentially.

Typical issues

  • Index fragmentation (especially with random GUIDs / UUIDs)
  • Lower cache locality
  • Larger indexes vs integers

Common mitigations

  • Prefer time-ordered GUIDs / UUIDs (e.g., v7)
  • Store as native GUID / UUID type where supported
  • Benchmark your workload (read/write patterns matter)
Read: GUID/UUID Database Performance & Indexing Guide

Standards and RFCs

GUID / UUID behavior is defined in official RFC standards. If you care about interoperability, always cross-check your GUID / UUID version and variant against the relevant RFC.

RFC 4122

Classic GUID / UUID specification (Published: July 2005) covering common versions (including v1-v5) and canonical formatting. Formally obsoleted by RFC 9562 in May 2024.

Open RFC 4122

RFC 9562

Modern GUID / UUID updates (Published: May 2024) including time-ordered versions such as v6 and v7, plus v8 for custom layouts.

Open RFC 9562
Read: RFC 4122 and RFC 9562

Tools

Use these tools to generate or inspect GUIDs / UUIDs. They are designed to be fast, developer-friendly and easy to reference from documentation and code reviews.

GUID / UUID Generator

Generate GUIDs / UUIDs for multiple versions and copy them in different formats (with braces, URN, etc.).

GUID / UUID Inspector

Paste any GUID / UUID to detect its version and variant. Plus see practical notes (ordering, security and privacy issues, legacy warnings, ...).

Open inspector GUID / UUID Regex Patterns - Validation & Best Practices

Privacy note: These tools do it all online inside your browser for free. No API calls needed. No data sent anywhere.

Learn more

These articles expand on related concepts, formats and practical considerations.

Disclaimer: All information is provided for general educational and technical reference only. While we aim to keep the content accurate, current and aligned with published standards. No guarantees are made regarding completeness, correctness or suitability for any specific use case.
GUID / UUID specifications, RFCs, best practices, security guidance, database behavior and ecosystem conventions (including cloud platforms and third-party identifier formats) may change over time or differ by implementation. Examples, recommendations, and comparisons are illustrative and may not apply universally.
This content should not be considered legal, security, compliance or architectural advice. Before making critical design, security, or production decisions, always consult the latest official standards and documentation (such as RFC 4122, RFC 9562 and vendor-specific references).
Always evaluate behavior in your own environment.