What is a UUID?

A UUID looks like this:

3fa85f64-5717-4562-b3fc-2c963f66afa6

That's 32 hexadecimal digits, grouped into five sections separated by dashes, for a total of 128 bits of information. Try generating one yourself with the UUID/GUID generator.

Why not just use a number that counts up (1, 2, 3...)?

Auto-incrementing IDs work fine inside a single database table, but they fall apart the moment you need uniqueness across multiple systems:

• Two microservices generating IDs independently will eventually produce the same number.
• Merging data from two databases (e.g. after an acquisition) causes ID collisions.
• Sequential IDs leak information - an attacker can guess /orders/1002 exists if /orders/1001 does.

A UUID solves all three: any machine, anywhere, with no coordination, can generate a UUID that is - for all practical purposes - guaranteed not to collide with one generated by anyone else, ever.

Where UUIDs show up

• Database primary keys - especially in distributed systems where multiple nodes insert rows independently.
• Session and request IDs - tracking a single HTTP request through logs across multiple services.
• File and object identifiers - cloud storage objects, document management systems.
• Device and installation IDs - uniquely identifying a phone, IoT device, or software install without exposing personal data.
• API keys and tokens - though these usually need additional cryptographic guarantees beyond plain UUIDs.

How is uniqueness actually guaranteed?

It isn't guaranteed in an absolute mathematical sense - it's guaranteed in a practical, "this will never realistically happen" sense. A random (version 4) UUID has 122 bits of randomness. To have even a 50% chance of one collision, you'd need to generate around 2.71 quintillion UUIDs. See UUID Format & Size for the exact math.

Next steps

Now that you know what a UUID is, you might want to read UUID vs GUID to clear up the naming confusion, or jump straight to UUID v4 vs v7 to pick the right version for a new project.