GUID & UUID Wiki

What is a GUID / UUID?

A GUID (Globally Unique Identifier), also called a UUID (Universally Unique Identifier), is a 128-bit identifier standardized by RFC 4122 for v4 and RFC 9562 for newer versions. It is designed to be globally unique, meaning no two GUIDs / UUIDs are expected to ever collide. Even when generated on different machines or at large scale.

GUIDs / UUIDs are widely used in databases, APIs, cloud services, distributed systems and software applications where reliable unique identifiers are essential. Their extremely low collision probability allows developers to create unique IDs without relying on a central authority or database lookup. Making them ideal for fast and scalable applications.

Universally Unique IDentifier (UUID) / Globally Unique IDentifier (GUID) - Wikipedia

GUID - Microsoft.com

GUID vs UUID - Are they the same?

In most real-world software, GUID and UUID refer to the same kind of identifier: a 128-bit value typically written as 32 hexadecimal digits in the familiar 8-4-4-4-12 format. The difference is mainly terminology and ecosystem — not the underlying concept.

Short answer: Yes, they're effectively the same.
“GUID” is common in Microsoft/Windows/.NET contexts. While “UUID” is the standard name used in IETF specifications and cross-platform tooling.

Quick comparison

TopicGUIDUUID
MeaningGlobally Unique IDentifierUniversally Unique IDentifier
Where you see it most Microsoft / Windows / .NET / SQL Server docs Standards (IETF), Linux/macOS tooling, databases, APIs
Bit length128-bit128-bit
Canonical text format8-4-4-4-128-4-4-4-12
Versions (v1–v8, Nil)Same versionsSame versions

Why people think they're different

  • Different naming: “GUID” is a Microsoft term while “UUID” is the standard term used by specifications and most cross-platform docs.
  • Different binary representations in some APIs: some platforms store or serialize GUID bytes in a different internal byte order than the canonical UUID string format.
  • Different default generators: libraries may default to different versions (e.g., v4 vs v7) even though the identifier type is still the same.

Canonical format and where “version” lives

Whether you call it a GUID or a UUID, the most common representation is a 36-character string (32 hex digits + 4 hyphens). The version is encoded as the first hex digit of the third group.

                    
                        Canonical format:  8-4-4-4-12
                        Example:           f47ac10b-58cc-4372-a567-0e02b2c3d479
                        Version nibble:    xxxxxxxx-xxxx-Vxxx-xxxx-xxxxxxxxxxxx
                                                         ^ V is the GUID / UUID version (1..8)
                        Variant nibble:    xxxxxxxx-xxxx-xxxx-Nxxx-xxxxxxxxxxxx
                                                              ^ N indicates the GUID / UUID variant (layout family)
                    
                

Variant meaning (practical view): the variant defines the layout family of the UUID — in other words, how the remaining bits should be interpreted. In modern software, almost all UUIDs you encounter use the RFC variant.

                    
                        Variant (high bits of the 4th group):
                        0xxx  → NCS (obsolete)
                        10xx  → RFC 4122 / RFC 9562 (standard, most common)
                        110x  → Microsoft (legacy GUID layout)
                        111x  → Reserved for future use
                    
                

Practical rule: if the first hex digit of the fourth group is 8, 9, a, or b, the GUID / UUID uses the standard RFC layout. That is what virtually all modern UUIDs use.

Warnings and pitfalls

  • GUID byte-order confusion: some systems store the first fields in little-endian order in memory or certain binary formats. Your string may look the same, but raw bytes might differ between platforms.
  • Not a secret: GUIDs / UUIDs are identifiers, not access tokens. Don't use them as “unguessable passwords” or authorization secrets.
  • Sorting behavior depends on representation: sorting by GUID / UUID string is not the same as sorting by raw bytes in every database/driver.

Conclusion

Use the term UUID when you want standards-aligned language and GUID when matching Microsoft/.NET naming. But treat them as the same underlying 128-bit identifier. The important part is choosing the right version (v4, v6 and v7) for your use case.

Comparison of UUID / GUID Versions

VersionTypeDeterministic?Sortable?Secure?Typical UseRFCNotes
v1Time + MACNoYesMAC leakDistributed systemsRFC 4122Includes timestamp + MAC address. Ordered but exposes hardware info.
v2DCE Security (UID/GID)NoPartialLeaks IDsLegacy DCE systemsRFC 4122Embeds POSIX UID/GID + MAC address. Rarely supported and considered obsolete.
v3Name (MD5)YesNoMD5Namespace-based IDsRFC 4122Deterministic, but MD5 is cryptographically broken.
v4RandomNoNoYesGeneral purpose (Recommended)RFC 4122Pure randomness (122 random bits). Extremely low collision probability.
v5Name (SHA-1)YesNoSHA-1Stable API IDsRFC 4122Deterministic like v3 but uses SHA-1, which is no longer fully secure.
v6Ordered time v1NoYesYesDatabase indexingRFC 9562Improved v1 format with sortable structure + privacy-safe design.
v7Timestamp + randomnessNoYesYesLatest most modernRFC 9562Combines millisecond timestamps with strong randomness. Ideal for distributed systems.
v8Custom / User-definedDependsDependsCustomExperimental, app-specificRFC 9562Flexible GUID / UUID layout reserved for application-defined use. Not recommended for generic scenarios.

Valid & Invalid GUID / UUID examples (all versions)

Below is a single consolidated reference showing a valid and an invalid example for every GUID / UUID version (v1-v8) plus the Empty Guid / Nil UUID. This focuses on format, version nibble and variant nibble.

All valid examples use the standard RFC variant (8, 9, a, or b as the first hex digit of the fourth group). Invalid examples demonstrate common real-world mistakes.

                    
Legend:
✓ = valid UUID (correct format, version, variant)
✗ = invalid UUID (wrong version nibble, variant, or format)

GUID / UUID v1 — Time-Based
✓ 6f9619ff-8b86-11d0-b42d-00c04fc964ff
✗ 6f9619ff-8b86-41d0-b42d-00c04fc964ff   (wrong version: 4 instead of 1)

GUID / UUID v2 — DCE Security
✓ 6f9619ff-8b86-21d0-b42d-00c04fc964ff
✗ 6f9619ff-8b86-12d0-b42d-00c04fc964ff   (wrong version: 1 instead of 2)

GUID / UUID v3 — Name-Based (MD5)
✓ 3d813cbb-47fb-32ba-91df-831e1593ac29
✗ 3d813cbb-47fb-42ba-91df-831e1593ac29   (wrong version: 4 instead of 3)

GUID / UUID v4 — Random-Based
✓ f47ac10b-58cc-4372-a567-0e02b2c3d479
✗ f47ac10b-58cc-5372-a567-0e02b2c3d479   (wrong version: 5 instead of 4)

GUID / UUID v5 — Name-Based (SHA-1)
✓ 987fbc97-4bed-5078-8f07-9141ba07c9f3
✗ 987fbc97-4bed-4078-8f07-9141ba07c9f3   (wrong version: 4 instead of 5)

GUID / UUID v6 — Reordered Time-Based
✓ 1ec9414c-232a-6b00-b3c8-9f7c6e5d4a3b
✗ 1ec9414c-232a-7b00-b3c8-9f7c6e5d4a3b   (wrong version: 7 instead of 6)

GUID / UUID v7 — Unix Time-Ordered
✓ 018f3f5e-1c2d-7a9b-8f10-3c4d5e6f7a8b
✗ 018f3f5e-1c2d-6a9b-8f10-3c4d5e6f7a8b   (wrong version: 6 instead of 7)

GUID / UUID v8 — Custom / Application-Defined
✓ 12345678-1234-8abc-9def-0123456789ab
✗ 12345678-1234-4abc-9def-0123456789ab   (wrong version: 4 instead of 8)

Empty Guid / Nil UUID — All-Zero (special case)
✓ 00000000-0000-0000-0000-000000000000
✗ 00000000-0000-4000-8000-000000000000   (not Nil: version/variant bits set)

GUID / UUID regex patterns (validation)

Regex validation is best used for quick input checks (shape + hex digits). For stricter validation, you should also verify the version and variant bits and ideally parse to bytes using a trusted GUID / UUID library.

Important: regex can validate the format, but it cannot guarantee uniqueness, security or that a GUID / UUID was generated correctly.

1. Canonical GUID / UUID only (hyphenated)

Matches the standard 8-4-4-4-12 representation with hex digits (case-insensitive).

^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$

2. Canonical + version (1-8) + RFC variant (8/9/a/b)

Enforces that the UUID is one of the modern versions (1 through 8) and uses the standard RFC variant (8, 9, a, or b).

^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$

3. Accept common input variants (braces and URN)

Accepts any of these forms: uuid, {uuid}, or urn:uuid:uuid. This is useful for UI input fields where users paste different styles.

^(?:urn:uuid:)?(?:\{[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$

4. Empty GUID / Nil UUID (all zeros)

Sometimes you want to explicitly detect an Empty GUID / Nil UUID.

^00000000-0000-0000-0000-000000000000$

Practical notes

  • Normalize first: trim whitespace, optionally strip urn:uuid: and braces, then validate.
  • Prefer parsing in code: use your platform's UUID/GUID parser after regex checks to avoid edge cases.
  • Version and variant are separate: version is the first hex digit of the third group; variant is the first hex digit of the fourth group.
  • Don't over-constrain input: if your app accepts uppercase or braces, reflect that in validation and normalization, not in your database storage.

GUID / UUID v1 - Time-Based

RFC 4122 - ietf.org

GUID / UUID v1 is a time-based identifier. It combines a high-resolution timestamp with additional bits (a clock sequence and a node identifier) so that systems can generate IDs without a central database while keeping collisions extremely unlikely.

In practice, v1 GUIDs / UUIDs often look “sortable-ish” because the timestamp is embedded, but sorting behavior can depend on how GUID / UUID bytes are stored and compared. V1 is widely supported, but it comes with privacy considerations because the node field has historically been a device identifier (commonly based on a MAC address), though many implementations now randomize it.

Advantages of GUID / UUID v1

  • Predictable structure: easy to validate (version nibble 1 and standard variant bits).

Warnings for GUID / UUID v1

  • Severe privacy leakage: encodes creation time and historically the node field could reveal a device MAC address. Many implementations randomize the node, but you should not assume that.
  • Not ideal for public IDs: timestamps can make IDs more guessable and may expose activity patterns (e.g., “when was this record created?”).
  • Clock problems: if the system clock jumps backwards or has low resolution, generators must handle it correctly (often via clock sequence; behavior varies by implementation).
  • Sorting pitfalls: string sorting may look time-ordered, but true ordering depends on byte layout and how your platform stores GUIDs / UUIDs (some reorder bytes internally).
  • Implementation differences: node source (MAC vs random), clock handling and monotonicity strategies vary by library and OS.

Technical description

Bit layout (practical view): UUIDs are 128-bit values shown as 32 hex digits with hyphens: 8-4-4-4-12. V1 uses these main regions: a timestamp, a clock sequence and a node identifier.

Fields (what exists): the timestamp is a 60-bit count of 100-nanosecond intervals since 1582-10-15 (Gregorian epoch), stored across the first three groups (with the version bits mixed in). The clock sequence is 14 bits used to help avoid duplicates when time is not strictly increasing. The node is 48 bits, historically derived from a MAC address but often randomized today (varies by implementation).

Ordering behavior: v1 contains time information, but it is not a simple “timestamp prefix” in the string. Depending on storage/byte order, v1 may not sort exactly by creation time in your database or programming platform. Treat v1 as time-correlated, not guaranteed perfectly sortable.

                    
                        Canonical format:  8-4-4-4-12
                        Example (v1):      6f9619ff-8b86-11d0-b42d-00c04fc964ff
                        Version nibble:    xxxxxxxx-xxxx-1xxx-xxxx-xxxxxxxxxxxx
                                                         ^ first hex digit of the 3rd group is "1" for v1
                        Variant nibble:    xxxxxxxx-xxxx-xxxx-Nxxx-xxxxxxxxxxxx
                                                              ^ N is typically 8, 9, a or b (RFC variant)
                    
                

Practical rule: in the canonical string, the version is the first hex digit of the third group. For v1 it is 1. The variant is indicated by the high bits of the fourth group (often rendered as 8-b in hex for the common standard variant).

Conclusion

GUID / UUID v1 is usually a poor choice because it can leak creation time and possibly node-related metadata (MAC address). If you want time ordering with fewer privacy surprises, v7 is often preferred. If you want minimal embedded metadata, v4 remains a common default.

GUID / UUID v2 - DCE Security (POSIX UID/GID)

(Defined in DCE 1.1 specification, reserved in RFC 4122)

GUID / UUID v2 is a rarely used variant derived from GUID / UUID v1 and was originally intended for DCE (Distributed Computing Environment) security systems. It modifies the time-based v1 layout by replacing part of the identifier with a local domain and a local identifier. Such as a POSIX UID or GID.

In practice, GUID / UUID v2 was meant to embed operating-system level identity information into the GUID / UUID itself. Because this exposes sensitive metadata and was tightly coupled to DCE concepts. V2 never saw widespread adoption and is rarely implemented in modern GUID / UUID libraries.

Advantages of GUID / UUID v2

  • DCE integration: designed to work directly with DCE Security models and OS-level identity concepts.

Warnings for GUID / UUID v2

  • Severe privacy concerns: embeds OS-level identifiers (such as UID or GID). Which can leak sensitive security and user information.
  • Not formally standardized: there is no dedicated RFC that fully specifies UUID v2 behavior or guarantees interoperability.
  • DCE-specific design: tightly coupled to legacy DCE Security concepts that are rarely used today.
  • Very limited support: most GUID / UUID libraries do not generate or parse v2 UUIDs.
  • Not recommended for new systems: modern GUID / UUID versions provide better privacy, portability and standardization.

Technical description

Bit layout (practical view): UUID v2 uses the same overall 128-bit structure and canonical string format as other UUIDs (8-4-4-4-12). It is based on the v1 layout, but with modifications to support DCE Security.

Fields (what exists): v2 replaces part of the time_low field from v1 with a local identifier (such as a UID or GID). The local domain field specifies what kind of identifier is embedded (for example, user or group). The remaining fields include a timestamp, clock sequence and node identifier. Similar to v1. Exact usage varies and is not strictly specified.

Ordering behavior: because v2 is derived from v1, it contains time information, but the modification of the timestamp fields means ordering behavior is implementation-dependent and should not be relied upon for sorting.

                    
                        Canonical format:  8-4-4-4-12
                        Example (v2):      6f9619ff-8b86-21d0-b42d-00c04fc964ff
                        Version nibble:    xxxxxxxx-xxxx-2xxx-xxxx-xxxxxxxxxxxx
                                                         ^ first hex digit of the 3rd group is "2" for v2
                        Variant nibble:    xxxxxxxx-xxxx-xxxx-Nxxx-xxxxxxxxxxxx
                                                              ^ N tis typically 8, 9, a or b (RFC/DCE variant)
                    
                

Practical rule: the version is encoded as the first hex digit of the third group. For UUID v2, this digit is 2. Other internal fields should be treated as opaque and implementation-specific.

Conclusion

GUID / UUID v2 is a historical, DCE-specific variant that is rarely encountered in modern systems. While it builds on the time-based structure of v1, its lack of formal standardization, limited support and significant privacy drawbacks make it unsuitable for new applications. For modern designs, prefer v4 for randomness or v7 for time-ordered identifiers.

GUID / UUID v3 - Name-Based Identifier (MD5 Hash)

RFC 4122 - ietf.org

GUID / UUID v3 is name-based. Instead of being random or time-based, it is generated by hashing a name together with a namespace GUID / UUID using the MD5 hashing algorithm. The result is a deterministic identifier: the same namespace and name always produce the same GUID / UUID.

This makes v3 useful when you need stable, repeatable identifiers derived from existing data (for example, URLs, usernames or external IDs). However, because it relies on MD5, v3 is considered cryptographically weak and is generally discouraged for new designs.

Advantages of GUID / UUID v3

  • Deterministic output: the same namespace and name always generate the same GUID / UUID.
  • No coordination required: identifiers can be generated independently without shared state or central services.
  • Name-derived identity: useful for mapping existing identifiers (such as URLs or usernames) into a GUID / UUID form.
  • Globally unique per namespace: uniqueness is guaranteed as long as the namespace/name combination is unique.
  • Standardized behavior: generation rules are clearly defined in the UUID specification.

Warnings for GUID / UUID v3

  • Uses cryptographically broken MD5: MD5 is cryptographically broken and should not be used where collision resistance or security matters.
  • Predictable identifiers: anyone who knows the namespace and name can reproduce the GUID / UUID.
  • Not suitable for secrets: v3 GUIDs / UUIDs must never be used as authentication tokens or unguessable IDs.
  • No time ordering: v3 UUIDs have no temporal component and do not sort by creation time.
  • Legacy choice: for new systems, v5 (SHA-1) or other approaches are usually preferred over v3.

Technical description

Bit layout (practical view): UUID v3 follows the standard 128-bit UUID layout and canonical string format (8-4-4-4-12). The UUID is derived by computing an MD5 hash over:
namespace UUID (binary) + name (bytes).

Fields (what exists): the 128-bit MD5 hash output is used as the base value. Certain bits are then overwritten to indicate the version (3) and the variant (RFC-defined layout). No timestamp, counter or node identifier exists in v3.

                    
                        Canonical format:  8-4-4-4-12
                        Example (v3):      3d813cbb-47fb-32ba-91df-831e1593ac29
                        Version nibble:    xxxxxxxx-xxxx-3xxx-xxxx-xxxxxxxxxxxx
                                                         ^ first hex digit of the 3rd group is "3" for v3
                        Variant nibble:    xxxxxxxx-xxxx-xxxx-Nxxx-xxxxxxxxxxxx
                                                              ^ N is typically 8, 9, a or b (RFC variant)
                    
                

Practical rule: identify a v3 UUID by checking the first hex digit of the third group. If it is 3, the GUID / UUID is version 3. The remaining bits represent the MD5-derived value with reserved version and variant bits applied.

Namespaces: the specification defines well-known namespace GUIDs / UUIDs (such as DNS, URL, OID, and X.500), but custom namespaces may also be used. Uniqueness is guaranteed only within the context of the chosen namespace.

Conclusion

GUID / UUID v3 provides deterministic, name-based identifiers that are useful for stable mappings and legacy interoperability. However, because it relies on MD5 and produces predictable values, it is generally avoided in new systems. When name-based GUIDs / UUIDs are required today, v5 (SHA-1) is usually the preferred alternative.

GUID / UUID v4 - Random-Based

RFC 4122 - ietf.org

GUID / UUID v4 is the most common type on the web and in many application frameworks. It is designed to be generated from randomness (or a pseudorandom generator). It does not require a clock, a device identifier or a central authority.

In practice, a v4 GUID / UUID is a 128-bit value where most bits are random, with a few bits reserved to indicate the GUID / UUID version (v4) and the GUID / UUID variant (the layout rules used). When generated with a good random source, collisions are extremely unlikely.

Advantages of GUID / UUID v4

  • No coordination required: UUIDs can be generated independently on any machine without a central authority or database.
  • High security and privacy: contains no timestamps, MAC addresses, or embedded metadata that could reveal system information.
  • Simple and widely supported — implemented in virtually all programming languages, databases, frameworks and platforms.
  • Excellent for distributed systems: ideal for microservices, offline clients, cloud environments and multi-region architectures.
  • Stateless generation: requires no counters, clocks or shared state. Reducing complexity and failure modes.
  • Fast and scalable: generation is usually CPU-cheap and parallel-friendly.
  • Easy to validate: the version nibble and variant bits allow quick sanity checks during parsing.

Warnings for GUID / UUID v4

  • Not sortable by time: v4 GUIDs / UUIDs are essentially random, so ordering does not reflect creation order.
  • Index fragmentation risk: inserting random keys into some database indexes can cause page splits and slower writes (impact varies by database and configuration).
  • Implementation differences: “random” vs “pseudorandom” and entropy sources can vary by platform and environment.

Technical details

Bit layout (practical view): a GUID / UUID is 128 bits written in a canonical 36-character string format: 32 hexadecimal digits plus 4 hyphens (8-4-4-4-12). For v4, the value is mostly random bits, with two practical markers: the version and the variant.

Fields (practical view): historically the GUID / UUID layout names include time-related fields (like time_low, time_mid and time_hi_and_version) plus clock_seq and node. In v4, these named regions are not interpreted as time or node data. They are effectively random (except for the reserved bits).

                    
                        Canonical format:  8-4-4-4-12
                        Example (v4):      5c98eda8-b852-4eec-9960-ac2e29d734f4
                        Version nibble:    xxxxxxxx-xxxx-4xxx-xxxx-xxxxxxxxxxxx
                                                         ^ the first hex digit of the 3rd group is "4" for v4
                        Variant nibble:    xxxxxxxx-xxxx-xxxx-Nxxx-xxxxxxxxxxxx
                                                              ^ N is typically 8, 9, a or b (RFC variant)
                    
                

Tip: in the canonical string, the version is the character at position 15 (1-based) if you count only hex digits or position 15 including hyphens?
It's easiest to remember: first hex of the third group encodes the version.

Randomness: a GUID / UUID is designed to be generated entirely from randomness or pseudorandom numbers.
A version-4 GUID / UUID has 122 bits of randomness (with 6 predetermined variant/version bits), providing 2¹²² possible combinations.
That’s approximately:

5.3 × 10³⁶ unique values

To put this into perspective:

  • The chance of two randomly generated UUIDs colliding is so small that it is considered mathematically negligible.
  • Even if you generated 1 billion UUIDs per second, non-stop, for 100 years, the probability of producing a duplicate is still effectively zero.
  • The GUID / UUID space is so large that every human on Earth could generate trillions of GUIDs / UUIDs without ever producing a duplicate

Conclusions

In practice, v4 GUIDs / UUIDs are unique enough for nearly all applications. From databases and distributed systems to cloud services and APIs. They require no coordination or central authority to ensure uniqueness. Making them excellent for decentralization, parallelization and simplicity.

GUID / UUID v5 - Name-Based Identifier (SHA-1)

RFC 4122 - ietf.org

GUID / UUID v5 is name-based that produces identifiers by hashing a namespace GUID / UUID together with a name using the SHA-1 hashing algorithm. The result is deterministic: the same namespace and name always generate the same GUID / UUID.

This makes v5 useful when you need stable, repeatable identifiers derived from existing data (such as URLs, DNS names, usernames or external IDs) while avoiding randomness and coordination. Compared to v3, v5 replaces MD5 with SHA-1 and is generally preferred for modern systems.

Advantages of GUID / UUID v5

  • Deterministic generation: the same inputs always produce the same GUID / UUID, which is ideal for idempotent operations and stable mappings.
  • No coordination required: GUIDs / UUIDs can be generated independently without shared state or a central authority.
  • Namespace isolation: identical names in different namespaces produce different GUIDs / UUIDs.
  • More robust than v3: uses SHA-1 instead of MD5, avoiding known weaknesses of MD5.
  • Standardized behavior: generation rules are clearly defined and consistent across platforms.
  • Useful for data modeling: convenient for deriving GUIDs / UUIDs from existing identifiers or content.

Warnings for GUID / UUID v5

  • Uses SHA-1: while stronger than MD5, SHA-1 is considered weak for cryptographic security and should not be relied on for collision resistance in adversarial scenarios.
  • Predictable values: anyone who knows the namespace and name can reproduce the GUID / UUID.
  • Not a security token: v5 GUIDs / UUIDs must not be used as secrets, access tokens or unguessable GUIDs / UUIDs.
  • No time ordering: v5 GUIDs / UUIDs contain no timestamp and do not sort by creation time.
  • Input stability required: changes in name encoding or normalization will produce different GUIDs / UUIDs.

Technical description

Bit layout (practical view): UUID v5 follows the standard 128-bit UUID layout and canonical string format (8-4-4-4-12). The UUID is computed by hashing: namespace UUID (binary) + name (bytes) using SHA-1.

Fields (what exists): the first 128 bits of the SHA-1 hash output are used as the base value. Certain bits are then overwritten to encode the version (5) and the variant (RFC-defined layout). There is no timestamp, counter, or node identifier in v5.

                    
                        Canonical format:  8-4-4-4-12
                        Example (v5):      987fbc97-4bed-5078-8f07-9141ba07c9f3
                        Version nibble:    xxxxxxxx-xxxx-5xxx-xxxx-xxxxxxxxxxxx
                                                         ^ first hex digit of the 3rd group is "5" for v5
                        Variant nibble:    xxxxxxxx-xxxx-xxxx-Nxxx-xxxxxxxxxxxx
                                                              ^ N is typically 8, 9, a or b (RFC variant)
                    
                

Practical rule: to identify a v5 GUID / UUID, look at the first hex digit of the third group. If it is 5, the GUID / UUID is version 5. All other bits are derived from the SHA-1 hash with reserved version and variant bits applied.

Namespaces: the specification defines well-known namespaces (DNS, URL, OID, X.500), but custom namespaces can also be created. Uniqueness is guaranteed only within the chosen namespace and name combination.

Conclusion

GUID / UUID v5 is the preferred choice when you need deterministic, name-based identifiers without relying on randomness or coordination. While it should not be used for security-sensitive purposes, it is well-suited for stable mappings, idempotent operations and derived identifiers in modern systems.

GUID / UUID v6 - Reordered Time-Based Identifier

RFC 9562 - ietf.org

GUID / UUID v6 is a time-based UUID designed to be sortable by creation time using simple string/byte comparisons. It is essentially GUID / UUID v1 with the timestamp bytes reordered so that the most significant time bits come first.

Practically, this makes v6 attractive for databases and storage engines that suffer when keys are inserted in random order. If you already use v1 (or must remain compatible with v1-style fields), v6 provides the same information while behaving better in indexes.

Like v1, v6 can include a node identifier (often a MAC address) and a clock sequence. Many implementations replace the node identifier with a random 48-bit value for privacy, but behavior can vary by implementation.

Advantages

  • Lexicographically sortable by time: values generated later generally sort after earlier ones without parsing fields.
  • Better database locality: reduced index fragmentation compared to fully random GUIDs / UUIDs in many common B-tree style indexes.
  • Field-compatible with v1: keeps the familiar concepts of timestamp, clock sequence, and node identifier while improving ordering.
  • No central coordination required: can be generated independently across machines and services.
  • Good for distributed IDs with ordering: helps when you want IDs that roughly reflect creation order (logs, events, records).
  • Easy validation: version nibble and variant bits provide quick sanity checks during parsing.
  • Works in the standard GUID / UUID string format: stays compatible with the canonical 8-4-4-4-12 representation and common tooling.

Warnings

  • Privacy risk if MAC-based node IDs are used: v6 can embed a hardware identifier (like v1). Prefer a random node ID if you don't want host tracking.
  • Not “secret” or unguessable: time-ordered IDs can leak creation timing patterns and may be more predictable than purely random IDs.
  • Ordering is “generally” time-based, not absolute: clock skew, clock adjustments or multi-node generation can still produce out-of-order values.
  • Implementation differences: how the clock sequence and node fields are initialized (random vs legacy behavior) can vary by implementation.
  • Collision handling depends on generator quality: a bad clock strategy, repeated state, VM cloning or a reused node/sequence combination can increase collision risk in flawed implementations.
  • Prefer v7 for new systems: RFC 9562 recommends GUID / UUID v7 for systems that don't need legacy v1 semantics, since v7 uses a Unix-time-based design and is commonly favored for modern DB keys.

Technical description

What fields exist: GUID / UUID v6 reuses the same building blocks as GUID / UUID v1: a 60-bit timestamp (Gregorian epoch, 100-nanosecond units), a clock sequence (used to help uniqueness when time doesn't strictly increase) and a 48-bit node identifier (traditionally a MAC address, but often randomized for privacy).

Ordering behavior: v6 is designed so the timestamp bytes appear from most significant to least significant early in the GUID / UUID. That means a straightforward lexical sort of the canonical string usually groups values in creation-time order (unlike v1, where time bits are split in a way that breaks simple sorting).

Version and variant in practice: the GUID / UUID version is encoded in the first hex digit of the third group (it will be 6 for v6). The most common layout variant used on the web and in RFC 9562 is the “DCE” variant, where the variant bits are 10xx in the relevant byte.

                    
                        Canonical format:  8-4-4-4-12
                        Example (v6):      1ec9414c-232a-6b00-b3c8-9c9b5f0a2b1d
                        Version nibble:    xxxxxxxx-xxxx-6xxx-xxxx-xxxxxxxxxxxx
                                                         ^ first hex of the 3rd group is "6" for v6
                        Variant nibble:    xxxxxxxx-xxxx-xxxx-Nxxx-xxxxxxxxxxxx
                                                              ^ N is typically 8, 9, a or b (RFC variant)
                    
                

Tip: when you split a UUID into 8-4-4-4-12, the first hex character of group 3 is the version. If it's 6, it's GUID / UUID v6.

Practical bit layout (high level): GUID / UUID v6 starts with the higher timestamp bits first (time_high then time_mid), inserts the version nibble, then stores the remaining lower timestamp bits (time_low). The clock sequence and node fields follow in the same relative positions as v1.

Conclusions

Use UUID v6 when you want a UUID that is time-based like v1 but also sorts naturally in databases and logs. If you're designing a new system without v1 compatibility needs, consider UUID v7 instead. And if you do use v6, prefer implementations that avoid exposing MAC addresses unless you explicitly need them.

GUID / UUID v7 - Unix Time-Ordered Identifier

RFC 9562 - ietf.org

GUID / UUID v7 is a timestamp-prefixed UUID format designed to be both globally unique and roughly sortable by creation time. It is often used as a database key or event identifier where random GUIDs / UUIDs (like v4) can cause index fragmentation.

A v7 GUID / UUID starts with a Unix Epoch timestamp in milliseconds (48 bits), followed by random bits to ensure uniqueness. Because the time component is stored in big-endian form at the front, v7 GUIDs / UUIDs tend to cluster by time when sorted, which is usually friendlier for B-tree indexes and log/event ordering.

Advantages of GUID / UUID v7

  • Time-ordered (practical sorting): the leading millisecond timestamp makes v7 GUIDs / UUIDs generally sortable by creation time when stored/compared in standard GUID / UUID byte order.
  • Great for databases: tends to reduce random insert patterns compared to v4. Improving index locality in many B-tree setups.
  • Distributed-friendly: can be generated independently on many nodes without coordination or a centralized service.
  • Low collision risk: combines a timestamp prefix with substantial randomness (remaining bits), making duplicates extremely unlikely with a proper generator.
  • Simple to validate: the version nibble is always 7 and the variant bits indicate the RFC-defined layout (most commonly 10xx in the canonical string as 8-b).
  • Works well for event streams: useful for IDs that are frequently listed “newest first” or partitioned by time windows.
  • Modern standard: standardized in RFC 9562 (which updates and supersedes RFC 4122).

Warnings for GUID / UUID v7

  • Timestamp disclosure: v7 encodes an approximate creation time (millisecond epoch). Which can leak timing metadata in public IDs or URLs.
  • Ordering is “best effort”: within the same millisecond, ordering depends on random/counter behavior (varies by implementation), so strict monotonicity is not guaranteed everywhere.
  • Clock issues matter: skewed clocks, time going backwards or low-resolution timers can reduce ordering quality and may require special handling in high-throughput generators.
  • GUID byte-order pitfalls: some platforms (notably certain “GUID” binary layouts) reorder bytes when storing/serializing. That can break expected “sort by time” behavior unless you store/compare in standard GUID / UUID byte order.
  • Not a security token: v7 is an identifier, not an access secret. Don't treat it as unguessable authorization (even though it has randomness).
  • Implementation differences: some generators may use part of the random region as a counter for monotonicity; others use purely random bits. Treat internal subfields beyond version/variant as opaque.

Technical description

Bit layout (practical view): a UUID is 128 bits displayed as 32 hex digits with hyphens: 8-4-4-4-12. For v7, the most significant bits begin with a 48-bit Unix timestamp (ms), then the version field (0111 → hex 7), then the remaining bits are used for uniqueness (commonly random; some implementations may incorporate a counter).

Fields you'll see in practice: the first 12 hex digits (48 bits) correspond to the timestamp. The first hex digit of the third group encodes the version (must be 7). The first hex digit of the fourth group encodes the variant (commonly 8, 9, a, or b for the RFC variant used by most UUIDs). Everything else is used for uniqueness and is not meant to be interpreted as a MAC address or node ID.

                    
                        Canonical format:  8-4-4-4-12
                        Example (v7):      018f3f5e-1c2d-7a9b-8f10-3c4d5e6f7a8b
                        Version nibble:    xxxxxxxx-xxxx-7xxx-xxxx-xxxxxxxxxxxx
                                                         ^ first hex digit of the 3rd group is "7"
                        Variant nibble:    xxxxxxxx-xxxx-xxxx-Nxxx-xxxxxxxxxxxx
                                                              ^ N is typically 8, 9, a or b (RFC variant)
                    
                

Practical rule: to identify v7 from the string, look at the first hex digit of the third group. If it's 7, its version 7. The first hex digit of the fourth group indicates the GUID / UUID variant (most commonly 8-b for the standard RFC layout).

Ordering behavior: because the timestamp is stored at the front (big-endian), sorting v7 UUIDs in their standard byte/string form generally groups them by time. Within the same millisecond, order is influenced by the remaining bits (random and/or counter), so ordering is typically time-correlated, not perfectly sequential.

Conclusion

GUID / UUID v7 is a strong default when you want UUID-style decentralization but also want IDs that behave better in ordered storage (like many database indexes). Use it when time-correlation is helpful and prefer v4 when you need to avoid exposing creation time in the identifier.

GUID / UUID v8 - Custom / Application-Defined Identifier

RFC 9562 - ietf.org

GUID / UUID v8 is a flexible, application-defined format. Unlike other GUID / UUID versions, v8 does not prescribe how most bits are generated. Instead, it provides a standardized container that allows applications to define their own internal structure while still producing a valid GUID / UUID string.

This version exists to support custom identifier schemes that need to fit into the GUID / UUID ecosystem (databases, APIs, tooling, ...) without pretending to be time-based, random or name-based. The specification intentionally leaves most semantics up to the application.

Advantages of GUID / UUID v8

  • Maximum flexibility: applications can define their own bit layout, encoding, or semantics.
  • Standards-compliant container: still conforms to the UUID string format and variant rules.
  • Future-proof: enables new UUID-like designs without requiring new version numbers.
  • Interoperable shape: works with existing UUID parsers, databases, and APIs.
  • Explicit intent: clearly signals that the UUID does not follow predefined semantics like v1-v7.

Warnings for GUID / UUID v8

  • No guaranteed uniqueness model: uniqueness depends entirely on the application's design.
  • No implied ordering: v8 does not guarantee time ordering or sortability unless explicitly designed to.
  • Opaque to other systems: external systems cannot infer meaning from the bits.
  • Easy to misuse: poor custom designs can lead to collisions or confusing behavior.
  • Not a security primitive: v8 provides no cryptographic guarantees by itself.

Technical description

Bit layout (practical view): UUID v8 follows the standard 128-bit UUID layout and canonical string format (8-4-4-4-12). Only two parts are fixed: the version field (8) and the variant field (RFC-defined). All remaining bits are application-defined.

Fields (what exists): aside from the required version and variant bits, the specification does not define any mandatory fields such as timestamps, randomness, counters or node identifiers. Applications may encode time, randomness, hashes, counters or other data as they see fit.

                    
                        Canonical format:  8-4-4-4-12
                        Example (v8):      12345678-1234-8abc-9def-0123456789ab
                        Version nibble:    xxxxxxxx-xxxx-8xxx-xxxx-xxxxxxxxxxxx
                                                         ^ first hex digit of the 3rd group is "8" for v8
                        Variant nibble:    xxxxxxxx-xxxx-xxxx-Nxxx-xxxxxxxxxxxx
                                                              ^ N is typically 8, 9, a or b (RFC variant)
                    
                

Practical rule: the version is encoded as the first hex digit of the third group. For GUID / UUID v8, this digit is 8. All other bits should be interpreted according to application-specific rules.

Ordering behavior: v8 GUIDs / UUIDs have no inherent ordering. Any ordering or monotonic behavior must be explicitly designed and documented by the application generating them.

Conclusion

GUID / UUID v8 is a powerful escape hatch for advanced use cases where none of the predefined GUID / UUID versions fit. It should be used deliberately and documented clearly, as its meaning and guarantees exist entirely outside the GUID / UUID standard. For most applications, v4, v6 or v7 remain better defaults.

Empty GUID / Nil UUID - All-Zero Identifier

An empty GUID (also called a nil UUID) is a valid GUID / UUID value defined by the specification, where all 128 bits are set to zero.
It is represented as:
00000000-0000-0000-0000-000000000000

GUID / UUID Version vs Variant - What's the difference?

Version and variant are two separate concepts in a GUID / UUID. They are often confused because both are encoded as single hexadecimal digits, but they answer different questions and live in different positions inside the GUID / UUID.

In one sentence:
The version tells you how the GUID / UUID was generated, while the variant tells you how to interpret the GUID's / UUID's layout.

Where version and variant live

                    
                    Canonical format:  8-4-4-4-12
                    Layout:            xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx
                    M = Version
                    N = Variant
                
                

The GUID / UUID version is encoded in the first hex digit of the third group. The GUID / UUID variant is encoded in the first hex digit of the fourth group.

GUID / UUID Version

The version defines the generation strategy used to create the GUID / UUID. It answers the question: “Where did this identifier come from?”

GUID / UUID Variant

The variant defines the layout family of the GUID / UUID. It answers the question: “How should the bits of this GUID / UUID be interpreted?”

The variant is independent of the version. Every GUID / UUID version uses a variant, including modern ones like v7 and v8.

                    
                    Variant nibble (first hex of 4th group):
                    0xxx  → NCS (obsolete)
                    10xx  → RFC 4122 / RFC 9562 (standard)
                    110x  → Microsoft legacy GUID
                    111x  → Reserved for future use
                    
                

Practical rule: if the first hex digit of the fourth group is 8, 9, a or b. The GUID / UUID uses the standard RFC layout. This is what almost all modern GUIDs / UUIDs use.

Version vs Variant (side by side)

AspectVersionVariant
PurposeHow the GUID / UUID was generatedHow the GUID / UUID layout should be interpreted
Location3rd group, first hex digit4th group, first hex digit
Typical values1-88, 9, a, b
Changes per GUID / UUID typeYesNo (almost always RFC)
Used by all GUIDs / UUIDsYesYes

Common misconceptions

  • “Only some versions have a variant”: false - all UUID versions include a variant.
  • “Variant means version family”: false - variant defines layout, not generation method.
  • “Variant affects uniqueness”: false - uniqueness comes from the generation algorithm.

Conclusion

Version and variant solve different problems and should always be treated separately. When documenting or validating GUIDs / UUIDs, show both the version to explain behavior and the variant to confirm the standard layout.

RFC 4122 vs RFC 9562

GUIDs / UUIDs are defined by IETF standards (RFCs). For many years, developers referenced RFC 4122, but this document has been formally obsoleted by RFC 9562. This comparison explains what changed, what stayed the same, and which RFC you should reference today.

TL;DR: RFC 9562 is the current GUID / UUID standard. RFC 4122 is still widely referenced but should be treated as a historical document.
AspectRFC 4122 (2005)RFC 9562 (2024)
StatusObsolete
Formally replaced
Current standard
Authoritative reference
Primary roleOriginal GUID / UUID specification used by most legacy systemsModern replacement that updates, clarifies and extends GUID / UUID definitions
Defined UUID versionsv1, v2 (reserved), v3, v4, v5v1, v2 (reserved), v3, v4, v5, v6, v7, v8
v2 (DCE Security)Reserved, not fully specifiedReserved, explicitly acknowledges DCE origin (still not fully specified)
Time-ordered UUIDsNot addressed
Sorting issues left to implementations
Explicitly addressed via v6 and v7
Custom GUID / UUID layoutsNot supportedSupported via v8 (application-defined)
Ambiguity resolutionSeveral behaviors left implicit or unclearClarifies generation rules, intent and modern usage expectations
URN namespaceDefines urn:uuid:Retains and reaffirms urn:uuid:
Security guidanceLimited discussionClearer warnings about predictability, privacy and misuse as secrets
Modern database considerationsNot explicitly addressedAcknowledges ordering, index locality and real-world storage concerns
Recommended for new systems No Yes

Key takeaways

  • RFC 9562 supersedes RFC 4122: it is the official, current GUID / UUID standard.
  • Nothing “breaks”: existing GUIDs / UUIDs generated under RFC 4122 remain valid.
  • New versions matter: v6 and v7 directly address long-standing database and ordering problems.
  • Documentation should cite RFC 9562: with optional mention of RFC 4122 for legacy context.

Practical advice for developers

  • If you generate new GUIDs / UUIDs, reference RFC 9562 in documentation.
  • If a library mentions “RFC 4122 GUIDs / UUIDs”, it usually still produces valid GUIDs / UUIDs — the wording is just outdated.
  • Prefer v4 for simplicity and v6 or v7 for time-ordered IDs.

Conclusion

RFC 4122 laid the foundation for GUIDs / UUIDs and powered the web for nearly two decades. RFC 9562 modernizes that foundation without breaking compatibility, making it the correct reference point for all new GUID / UUID documentation and system design today.

GUID/UUID vs ULID vs KSUID - Which Identifier Should You Use?

Compare GUID / UUID, ULID and KSUID for databases and distributed systems. Learn the key differences, use cases, trade-offs and when to choose each.

GUIDs / UUIDs are the most widely supported identifiers across databases, APIs and programming languages. However, many systems also use GUID/UUID-like alternatives such as ULID and KSUID to get better time ordering and improved database index locality.

Cloud platforms like AWS typically do not introduce their own GUID / UUID versions. Instead, they use standard IDs like ARNs and service-specific IDs and sometimes standard GUIDs / UUIDs (often v4) for request/event IDs. So when you're choosing an identifier for your own app or database schema, you're usually deciding between standard GUIDs / UUIDs and non-standard GUID/UUID-like formats such as ULID / KSUID.

Quick recommendation: If you want the safest, standards-based choice, use GUID / UUID v4 (general purpose) or UUID v7 (time-ordered for databases). Consider ULID or KSUID only when you explicitly want their ecosystems and trade-offs.

Comparison table

IdentifierSizeEncodingTime-sortableStandardBest for
GUID / UUID v4128-bitHex (8-4-4-4-12) No RFC (GUID / UUID)General-purpose IDs, privacy-friendly identifiers
GUID / UUID v7128-bitHex (8-4-4-4-12) Yes RFC (GUID / UUID)Database primary keys, event ordering, time-correlated IDs
ULID128-bitBase32 (26 chars) Yes Not RFC GUID / UUIDHuman-friendly sortable IDs, systems already using ULIDs
KSUID160-bitBase62 (27 chars) Yes Not RFC GUID / UUIDTime-sortable IDs with large space, log/event-heavy systems

Which one should you use?

  • Choose GUID / UUID v4 if you want the safest default: widely supported, easy to store, no time metadata and simple generation.
  • Choose GUID / UUID v7 if you want a standards-based ID that is time-ordered and typically behaves better as a database primary key than random GUIDs / UUIDs.
  • Choose ULID if you want time-sortable IDs and prefer a compact, human-friendly Base32 string representation (and your stack already supports it).
  • Choose KSUID if you want time-sortable IDs with a larger space and you're in an ecosystem that already uses KSUIDs for logs/events—and you accept that it's not a GUID / UUID.

Practical guidance for databases

If your main concern is database performance and index locality, you usually want identifiers that don't insert randomly across the index. That's the most common reason developers compare GUID / UUID v7, ULID and KSUID.

  • Most compatible: GUID / UUID v4 (works everywhere, but can be random for indexes)
  • Best “standard + sortable” combo: GUID / UUID v7 (time-ordered while staying a real GUID / UUID)
  • Non-standard but popular: ULID / KSUID (sortable, but may require extra tooling and conventions)

Warnings & trade-offs

  • GUIDs / UUIDs are not secrets: GUID / UUID v4/v7, ULID, and KSUID are identifiers. Do not use them as access tokens or authentication secrets.
  • Sorting depends on representation: “time-sortable” usually means the string form sorts by time, but database storage/byte-order can change behavior (varies by database/driver).
  • Non-standard formats: ULID and KSUID are not RFC UUIDs. Some APIs, ORMs, and databases assume GUID / UUID formatting and won't accept them without custom handling.
  • Time leakage: time-ordered IDs can reveal approximate creation time. If that matters, prefer GUID / UUID v4 or treat IDs as private/internal.
  • Interoperability matters: if you work across many systems or languages, GUIDs / UUIDs typically win due to universal support.

Mini FAQ

No. ULID is a GUID/UUID-like identifier (128-bit) with a different text encoding and different standardization. If you need a standards-based GUID / UUID, prefer GUID / UUID v4 or v7.
No. KSUID is not an RFC UUID. It's a different identifier format designed to be k-sortable (roughly sortable by time) using a larger bit size and Base62 encoding. If you need interoperability with databases/APIs expecting GUIDs / UUIDs. Prefer GUID / UUID v4 or v7.
A common modern choice is GUID / UUID v7 because it remains a real UUID while offering time-ordered behavior. GUID / UUID v4 is the simplest universal option, but can cause more random insert patterns in some index designs.
AWS primarily uses service-specific identifiers (like ARNs and instance IDs). Some AWS services also emit standard GUIDs / UUIDs (often v4) for request IDs or event IDs. But AWS does not define a custom GUID / UUID version.

Conclusion

If you want broad interoperability, choose a standard UUID: GUID / UUID v4 for general-purpose IDs or GUID / UUID v7 for time-ordered database-friendly identifiers. Choose ULID or KSUID when your ecosystem already uses them or when their encoding and operational trade-offs are a deliberate fit for your system.

Supported GUID / UUID versions by this generator

This generator intentionally supports only secure, modern GUID / UUID versions — v4, v6, and v7. Older or deprecated versions such as v1, v2, v3, v5 and v8 are not supported because they rely on outdated hashing algorithms, expose hardware or user identifiers, lack modern security guarantees or are intended for custom implementations without standardized structure.

Disclaimer: All information is provided for general educational and technical reference only. While we aim to keep the content accurate, current and aligned with published standards. No guarantees are made regarding completeness, correctness or suitability for any specific use case.
GUID / UUID specifications, RFCs, best practices, security guidance, database behavior and ecosystem conventions (including cloud platforms and third-party identifier formats) may change over time or differ by implementation. Examples, recommendations, and comparisons are illustrative and may not apply universally.
This content should not be considered legal, security, compliance or architectural advice. Before making critical design, security, or production decisions, always consult the latest official standards and documentation (such as RFC 4122, RFC 9562, and vendor-specific references).
Always evaluate behavior in your own environment.