What is a UUID? The Complete Guide to RFC 9562 and Modern Unique Identifiers

A UUID (Universally Unique Identifier) is a 128-bit label used to identify information across computer systems without needing a central coordinator. Now standardized under RFC 9562, it usually appears as a 36-character string. While UUIDv4 is common for random IDs, the newer UUIDv7 is the preferred choice for database indexing in 2026.

Understanding the 128-bit Number: What is a UUID?

The 128-bit Number provides the massive keyspace that lets distributed systems generate IDs on their own. This decentralization is a pillar of modern cloud architecture, as it removes the need for a central registry to make sure your identifiers don’t clash.

The standard display uses an 8-4-4-4-12 format (like 550e8400-e29b-41d4-a716-446655440000). Within this structure, the Leach-Salz Variant (Variant 1) is what makes modern systems play nice together. Specified in current IETF standards, this variant tells software—whether it’s running Java or Python—exactly how to read the 128-bit sequence so nothing gets lost in translation.

The Anatomy of a UUID String

A canonical UUID string is built from 32 hexadecimal digits and four hyphens. This isn’t just for looks; it originally mapped to version 1 components like time_low and node. Newer versions like UUIDv4 use those bits for randomness instead, but we keep the 36-character format so that old logs and APIs don’t break when they see a new ID.

RFC 9562: What is New in the 2026 UUID Standard?

In May 2026, the IETF published RFC 9562, replacing the aging RFC 4122. This update was necessary because the old versions couldn’t keep up with the scale of today’s distributed environments. The new standard brings UUIDv6, UUIDv7, and UUIDv8 into the fold, giving developers official, standardized ways to create time-ordered or custom IDs.

The big change in RFC 9562 is the move toward “database-friendly” identifiers. Older versions like UUIDv1 were time-based, but their bits were scrambled in a way that slowed down B-Tree indexes in relational databases. The 2026 standard fixes this by putting the most important time bits first, cutting out the performance “tax” that usually comes with random IDs.

Why UUIDv7 is the New Industry Gold Standard

UUID Version 7 (Time-Ordered) has quickly become the go-to for primary keys. It mixes a 48-bit Unix timestamp (in milliseconds) with 74 bits of randomness. As noted in the PostgreSQL Documentation, this version creates “monotonically ascending” keys. This means you get the global uniqueness of a UUID but with the fast insert speeds you’d expect from a simple sequential integer.

UUID Version 4 (Random): Why is it the Most Widely Used?

UUID Version 4 (Random) relies on cryptographically strong generators to pick numbers out of a hat. Since it doesn’t need a system clock or a hardware address, it’s the easiest version to drop into any project. It’s essentially a “blind” approach to uniqueness: the number of possibilities is so high that you can safely bet two systems will never pick the same one.

The trust in UUIDv4 comes down to the math behind Collision Probability. According to Wikipedia, you’d need to generate about 2.71 quintillion UUIDs before you hit a 50% chance of a single overlap. To put that in perspective, BiteCode points out that even at 1 billion IDs per second, it would take 86 years to reach that 50% mark. This makes v4 perfect for things like session IDs and security tokens where you don’t want any predictable patterns.

Privacy and Security: Understanding MAC Address Exposure

Early UUIDs, specifically version 1, ran into trouble with MAC Address Exposure. By baking the 48-bit node ID (the hardware address of your network card) into the identifier, these UUIDs leaked your machine’s identity and physical location.

The Melissa Virus Privacy Breach (2026) is a classic example of this risk. Investigators tracked down the creator by looking at the UUIDs hidden in infected Word documents, which contained the author’s unique MAC address. Modern versions like UUIDv4 and UUIDv7 avoid this entirely by using random bits, ensuring your IDs don’t spill any secrets about your infrastructure.

Performance Optimization: UUIDv7 vs. v4 for Database Primary Keys

Choosing between UUID Version 7 (Time-Ordered) and UUIDv4 usually comes down to how your database handles data. Random UUIDv4 values cause “B-Tree Fragmentation.” Because v4 is non-sequential, new rows get shoved into random spots in an index. This forces the database to split pages and work harder on disk I/O, which eventually drags down your write speeds.

In contrast, UUIDv7 is built for better index locality. Since the timestamp is at the front, new entries are added to the “end” of the index, much like an auto-incrementing ID. PostgreSQL now supports these time-ordered values natively, making range scans faster and inserts much smoother.

Implementation Matrix: When to Use Which Version

FAQ

What is the difference between a UUID and a GUID?

A GUID (Globally Unique Identifier) is just Microsoft’s name for the UUID standard. Under the hood, they are the same 128-bit structures. You’ll hear “GUID” more in Windows and .NET circles, but “UUID” is the universal term used by the IETF in RFC 9562.

Is it possible for two UUIDs to collide or be identical?

Theoretically, yes, but in practice, no. A collision for a properly made UUIDv4 is so unlikely it’s hard to visualize. You’d need quintillions of IDs before it even becomes a coin flip. For almost any app on the planet, they are considered unique.

Why is UUIDv7 preferred over UUIDv4 for database primary keys?

UUIDv7 is better because it includes a 48-bit timestamp at the start. This makes the IDs “sortable” by nature. When you insert them into a database, it keeps the index organized and prevents the performance drops you see with random v4 strings.

How do I generate a UUID in Python or JavaScript?

In Python, use the built-in uuid module (like uuid.uuid4()). In modern JavaScript (Node.js or browsers), crypto.randomUUID() handles it for you. For UUIDv7, support is rolling out to many standard libraries, though many developers currently use the uuidv7 package on NPM or the updated uuid module in Python 3.14+.

Conclusion

UUIDs have come a long way from basic random strings to the optimized, time-ordered identifiers we see in RFC 9562. They are still the best way to track data in distributed systems because they balance the need to work independently with the performance needs of modern databases.

If you’re building a database-backed app today, you should probably default to UUIDv7 for your primary keys. Use UUIDv4 for everything else, especially for internal tokens where you want complete unpredictability.