What a UUID is for
A UUID, or universally unique identifier, is a 128-bit value written as 36 characters in five hyphen-separated groups. Its purpose is to let independent systems generate identifiers that will not collide, without any of them needing to coordinate with a central authority.
That property is what makes UUIDs valuable in distributed systems. Two servers on opposite sides of the world can each mint an identifier at the same instant with no communication between them and be confident the values differ.
Version 4 and randomness
This generator produces version 4 UUIDs, which derive almost all their bits from random data. Six bits are fixed to mark the version and variant, leaving 122 random bits. That yields around 5.3 undecillion possible values.
The practical consequence of that number is that collisions are not something you need to plan for. To reach even a one in a billion chance of a single duplicate, you would need to generate roughly 100 trillion UUIDs. The randomness here comes from your browser's cryptographic random number generator, not the ordinary pseudo-random function, so the distribution is genuinely uniform.
Where developers use them
UUIDs commonly serve as database primary keys when records originate in multiple places — mobile clients creating rows offline, for instance, that sync later without renumbering. They appear as correlation identifiers in distributed tracing, letting a single request be followed across a dozen services. They are used for idempotency keys in payment APIs, for session identifiers, for file names in object storage, and for message identifiers in queues.
They are also chosen deliberately over sequential integers when you do not want your identifiers to leak information. A URL containing user 4821 tells an observer roughly how many users you have and invites them to try 4822. A UUID reveals nothing.
The trade-offs
UUIDs are not free. As a database primary key they occupy 16 bytes against 4 or 8 for an integer, and that cost multiplies across every index that references them. Random UUIDs also scatter inserts across a B-tree index rather than appending at the end, which fragments the index and hurts write performance on large tables. Databases such as MySQL with clustered indexes feel this most acutely.
Where this matters, UUID version 7 is worth knowing about. It embeds a timestamp in the leading bits so that generated values sort chronologically, giving you the uniqueness of a UUID with insert behaviour closer to a sequential key.
Format variants
The standard lowercase hyphenated form is what you want in most contexts. Uppercase and the braced form appear in Microsoft ecosystems, where GUIDs are conventionally written inside curly braces. The unhyphenated form saves four characters and shows up in URLs and compact storage formats. All represent the same underlying value.
Frequently Asked Questions
Can two UUIDs ever be the same?
In theory yes, in practice no. With 122 random bits you would need to generate around 100 trillion values before reaching a one in a billion chance of a single collision.
What is the difference between a UUID and a GUID?
They are the same thing. GUID is Microsoft's name for the format and is typically written uppercase inside curly braces, but the underlying 128-bit value is identical.
Are these generated securely?
Yes. They use your browser's cryptographic random number generator via crypto.randomUUID, not a general-purpose pseudo-random function.
Should I use UUIDs as database primary keys?
They are useful when records are created in multiple places or you do not want IDs to be guessable, but they cost more storage and can fragment indexes. UUID v7 addresses the index fragmentation problem.
Do I need an internet connection?
No. Generation happens entirely in your browser and continues to work offline once the page has loaded.