UUID Generator

This is the one thing worth taking away. A UUID is built so that two systems that have never spoken can each invent one and not clash — that is a promise about collisions, and nothing else. It is not a promise that nobody can work out the next one, and a UUID ends up in URLs, server logs, referrer headers and error reports, all places a secret must never be. If a link is only safe because the identifier in it is hard to find, generate a token instead.

A v4 does happen to be hard to guess: 122 of its 128 bits are drawn from chance, the other six spelling out the version and the variant. That is a side effect of how it is built rather than a guarantee it makes, and it disappears the moment you switch versions. A v7 keeps only 74 random bits, because the first 48 are the millisecond it was made — public information, and enough of a foothold that guessing one becomes a real exercise rather than an impossible one.

What v7 buys in return is order. Identifiers that arrive in ascending order land at the end of a database index instead of scattering across it, which is the difference between an index that appends and one that splits pages all day. If these are primary keys in a table that is written to constantly, that trade is usually worth making — and it is a trade, which is why it is worth making on purpose.

The numbers behind “will not collide” are less dramatic than they sound, and still overwhelming. Collisions follow the birthday bound, so the interesting figure is the square root of the space, not the space itself: with 122 random bits, it takes around 3.3 × 10^17 identifiers before there is even a one-in-a-hundred chance that any two of them match.

Every one of these is drawn here, in your browser, from the same cryptographic random source the rest of this site uses. Nothing is reserved, registered or checked against a list anywhere — there is no list, and that is the entire point of the format.