Understanding UUID v4: Randomness, Collision Probability & Standards

A Universally Unique Identifier (UUID), also known as a GUID (Globally Unique Identifier) in the Microsoft ecosystem, is a 128-bit label used for information in computer systems. Standardized under RFC 4122, UUIDs enable distributed systems to uniquely identify information without central coordination.

Among the various versions specified by RFC 4122, Version 4 (UUIDv4) is by far the most popular in modern web development and distributed architecture.

---

Anatomy of a UUID v4

A standard UUID is formatted as a 36-character string containing 32 hexadecimal characters and 4 hyphens, grouped in an 8-4-4-4-12 format:

xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
|      | |  | |  | |  | |          |
8 chars  4 ch 4 ch 4 ch   12 chars

In a UUID v4:

• The 13th character is always 4: Indicates RFC 4122 Version 4.
• The 17th character is always 8, 9, a, or b: Encodes the variant (bits 10xx in binary).
• The remaining 122 bits: Generated from a cryptographically secure pseudorandom number generator (CSPRNG).

---

The Collision Mathematics: Can Two UUIDs Collide?

A common question from engineers designing relational schemas is: Can two generated UUIDv4 keys ever collide?

Because 122 bits are purely random, there are 2^122 (approximately 5.3 × 10^36) possible unique combinations.

To put this into perspective:

• If you generate 1 billion UUIDs per second for 100 years, the probability of generating a single duplicate is less than 0.000000001 (one in a billion).
• The total number of atoms in human body is vastly smaller than the space of possible UUIDv4 permutations.

For all practical computing scenarios, UUIDv4 identifiers can be treated as globally unique without any central database locking.

---

When to Use UUIDs vs Auto-Incrementing Integers

| Feature | Auto-Increment BigInt | UUID v4 | | :--- | :--- | :--- | | Distributed Generation | Impossible without coordination | 100% Offline & Decentralized | | Security & Enumeration | Vulnerable to scraping (/users/102) | Opaque & Non-guessable | | B-Tree Indexing Size | Compact (8 bytes) | Larger (16 bytes binary / 36 bytes text) | | Page Fragmentation | Minimal (sequential append) | Higher without UUIDv7 sorting |

Generate bulk cryptographically secure tokens directly in our UUID Generator.