UUID & GUID Generator & Validator

UUID / GUID Engineering Architecture & RFC 4122 / 9562

A Universally Unique Identifier (UUID)—also standardized by Microsoft as a Globally Unique Identifier (GUID)—is a 128-bit numerical label used to uniquely identify information in computer systems without centralized coordination. Formalized under RFC 4122 and recently updated in RFC 9562, UUIDs guarantee uniqueness across distributed databases, microservices, and network nodes.

1. Bit-Level Layout & The 8-4-4-4-12 Canonical String

A UUID consists of 16 octets (128 bits), canonically rendered as a 36-character hexadecimal string divided into five groups separated by hyphens:

xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx
  time_low    mid  ver  var  node / random

• Version Digit (M): The high 4 bits of the 7th byte. For Version 4, this is always 4.
• Variant Digit (N): The high 2 or 3 bits of the 9th byte. Under RFC 4122, these bits are 10xx₂, restricting the first character of the fourth segment to 8, 9, a, or b (or uppercase 8, 9, A, B).

2. UUID Versions Compared

3. Collision Probability Mathematics

A Version 4 UUID reserves 6 bits for metadata (4 bits version, 2 bits variant), leaving exactly 122 bits of true cryptographic entropy. The total number of possible UUID v4 values is:

2¹²² ≈ 5.3169 × 10³⁶ unique values

By applying the Birthday Paradox approximation for collision probability $p \approx 1 - e^{-n^2 / (2 \times 2^{122})}$:

• To reach a 1 in a billion ($10^{-9}$) chance of collision, you would need to generate approximately 103 trillion UUIDs.
• If you generated 1 billion UUIDs every second continuously for 85 consecutive years, your cumulative probability of producing a single collision is approximately 50%.

4. Database Indexing & Storage Architecture

Engineers must carefully weigh how UUIDs are indexed in relational stores (PostgreSQL, MySQL, SQLite):

• Storage Footprint: A raw string UUID consumes 36 bytes in ASCII/UTF-8 (or 32 bytes without hyphens). In binary form, it occupies only 16 bytes. Always utilize native UUID in PostgreSQL or BINARY(16) in MySQL.
• B-Tree Index Fragmentation: Because UUID v4 values are completely random, inserting them into clustered index trees causes random page splits and high cache eviction rates. For high-write throughput workloads, modern systems migrate to time-prefixed identifiers (UUID v7 or ULID) to guarantee sequential append performance.

5. Frequently Asked Questions (FAQ)

Are the UUIDs generated here cryptographically secure?

Yes. This generator uses the browser's hardware-backed Web Crypto API (crypto.randomUUID() and crypto.getRandomValues()), ensuring high-entropy cryptographic security suitable for production sessions, access tokens, and primary keys.

What is the difference between a UUID and a GUID?

GUID (Globally Unique Identifier) is Microsoft's implementation of the UUID standard. Both represent identical 128-bit numbers and follow RFC 4122 specifications.

What is the Nil UUID?

The Nil UUID is a special identifier defined in RFC 4122 where all 128 bits are set to zero (00000000-0000-0000-0000-000000000000), commonly used as an initial placeholder or unassigned entity flag.

Why does the 13th character in UUID v4 always show '4'?

The 13th character represents the 4-bit version field (time_hi_and_version). A value of 4 designates that the identifier was generated using cryptographic pseudo-random numbers.