UUID v4 vs UUID v7
Purely random 128-bit identifiers vs time-ordered sortable 128-bit identifiers — Deep technical analysis of trade-offs, architecture, performance, security postures, and engineering decision frameworks.
Web Protocols & Security Architecture Research
UUID v4 vs UUID v7
For new database primary keys and distributed systems, UUID v7 is the superior, modern successor to UUID v4. UUID v4 remains ideal only when timestamp leakage is unacceptable or when ordering must not correlate with creation time.
What are UUID v4 and UUID v7?
UUID Version 4 (RFC 4122)
A 128-bit universally unique identifier created using cryptographically secure pseudorandom numbers, containing 122 bits of random entropy and 6 bits of version/variant metadata.
UUID Version 7 (RFC 9562)
A modern 128-bit identifier standardized in 2024 featuring a 48-bit big-endian timestamp field (milliseconds since Unix epoch) followed by 74 bits of random entropy.
3. Side-by-Side Comparison Matrix
| Feature / Dimension | UUID v4 | UUID v7 | Advantage |
|---|---|---|---|
Generation Entropy Both have practically zero collision probability | 122 bits purely random | 48-bit timestamp + 74 bits random | Tie / Context |
Database B-Tree Index Health UUID v7 speeds up database inserts dramatically | Severe fragmentation (Random page splits) | Optimal (Appends sequentially at index leaf) | UUID v7 |
Chronological Sortability Enables SELECT * ORDER BY id ASC | No (Completely random order) | Yes (Sorts naturally by creation millisecond) | UUID v7 |
Creation Time Leakage UUID v4 preserves timing privacy | None (Zero time information) | Leaks creation timestamp (millisecond precision) | UUID v4 |
RFC Standardization RFC 9562 is the modern IETF standard | RFC 4122 (Legacy, 2005) | RFC 9562 (Modern, 2024) | UUID v7 |
Native Database Support UUID v4 supported everywhere natively | Universal (PostgreSQL, MySQL, SQLite) | Rapidly expanding (Native in Postgres 17+ / libraries) | UUID v4 |
How do UUID v4 and UUID v7 differ technically?
B-Tree Database Index Fragmentation Elimination
Relational databases (PostgreSQL, MySQL InnoDB) store primary keys in clustered B-tree indexes. Because UUID v4 values are completely random, every new INSERT lands at a random page in the tree, forcing expensive disk page splits and thrashing RAM buffer pools. UUID v7 inserts sequentially at the right-most leaf, yielding append-only speeds comparable to serial integers.
Built-in Chronological Sorting Without Extra Indexes
Because the first 48 bits of a UUID v7 represent the Unix epoch millisecond, records can be sorted by creation time directly using ORDER BY id DESC. This eliminates the need to create a secondary B-tree index on created_at, saving significant disk space and write overhead.
Privacy and Timestamp Leakage Trade-Off
A UUID v7 reveals the exact millisecond when the ID was generated (e.g. 018e69fa-9481-...). In multi-tenant systems or public URLs, this can leak business intelligence (such as customer signup rates or order volumes). UUID v4 reveals zero timing metadata.
When should you use UUID v4 vs UUID v7?
When to Use UUID v4
Public-Facing Security Tokens and Session IDs
Where leaking the creation time could aid attackers in timing or correlation attacks.
Identifiers That Must Never Reveal Business Volume
Preventing competitors from estimating your daily order volume or user registration frequency.
Legacy Systems strictly limited to RFC 4122 libraries
Older environments lacking UUID v7 generators.
When to Use UUID v7
Database Primary Keys in PostgreSQL, MySQL, and SQLite
Eliminates index fragmentation and provides lightning-fast INSERT throughput.
Distributed Event Streaming (Kafka / RabbitMQ)
Messages naturally order by time across distributed partitions without central coordination.
Audit Logs and Time-Series Records
Sorting billions of log events chronologically with zero secondary index overhead.
Modern Alternative to ULID or Twitter Snowflake
UUID v7 is an official IETF RFC standard, avoiding proprietary ID formats.
What are the security differences between UUID v4 and UUID v7?
Neither UUID v4 nor UUID v7 should be used as secret authentication tokens or passwords. Both have 128-bit collision resistance, but UUID v7 leaks creation timestamps.
- ×Vulnerability to weak pseudorandom number generators (PRNG) generating predictable IDs
- ×Denial of Service via database index fragmentation thrashing server memory
- ×Information leakage (competitors extracting creation timestamps to estimate business growth)
- ×Clock skew / rollback issues on distributed servers (mitigated by monotonic counter bits)
- Always use cryptographically secure random number generators (CSPRNG) when minting UUIDs.
- For UUID v7, implement monotonic sequence increments if minting more than 1,000 IDs per millisecond on the same thread.
Which performs better: UUID v4 or UUID v7?
UUID v7 delivers up to 4x faster database write throughput and reduces index size by 30%–50% compared to UUID v4 on large datasets.
| Benchmark Metric | UUID v4 | UUID v7 |
|---|---|---|
| Database INSERT Throughput (10M rows) | ~2,500 inserts/sec (Degrades as tree fragments) | ~12,000+ inserts/sec (Consistent append-only speed) |
| B-Tree Index Fragmentation | High (> 60% empty space after splits) | Near Zero (Linear leaf packing) |
| Generation Latency | < 1 microsecond (CSPRNG call) | < 1 microsecond (Timestamp + CSPRNG) |
9. Side-by-Side Concrete Technical Examples
UUID v4 Example:
f47ac10b-58cc-4372-a567-0e02b2c3d479
^ ^
| |-- Variant (bits 10xx -> RFC 4122)
|------- Version 4 (0100)
Entropy breakdown:
- 122 bits: Purely random cryptographic bits
- 4 bits: Version 4 identifier (0100)
- 2 bits: RFC 4122 variant identifier (10)
- Total: 128 bits (36 characters with hyphens)UUID v7 Example:
018e69fa-9481-7c2a-9f44-8d9e2a1b3c4d
|-----------| ^ ^
| | |-- Variant (bits 10xx -> RFC 9562)
| |------- Version 7 (0111)
|--------------- 48-bit Unix Epoch Milliseconds
Entropy breakdown:
- 48 bits: Unix timestamp (1711123456789 ms -> valid until year 10889)
- 4 bits: Version 7 identifier (0111)
- 12 bits: Sub-millisecond sequence entropy
- 2 bits: RFC 9562 variant identifier (10)
- 62 bits: Cryptographic random entropy
- Total: 128 bits (Chronologically sortable!)What are common misconceptions about UUID v4 vs UUID v7?
UUID v7 was officially ratified by the IETF in 2024 as RFC 9562 ("Universally Unique IDentifiers"), making it the formal worldwide standard for time-sorted UUIDs.
UUID v7 still provides 74 bits of random entropy per millisecond. To have a 50% chance of a collision, you would need to generate over 1 billion UUIDs within the EXACT same millisecond.
Which should you choose: UUID v4 or UUID v7?
Standardize on UUID v7 for all new database tables, primary keys, and distributed message queues. Maintain UUID v4 only when creation time must remain strictly confidential.
Frequently Asked Questions About UUID v4 vs UUID v7
Q:How does UUID v7 compare to ULID?
ULID uses Crockford’s Base32 encoding (26 characters), whereas UUID v7 uses standard RFC 4122 hyphenated hex (36 characters). UUID v7 is natively compatible with existing database UUID column types (Postgres uuid type), whereas ULID requires custom string storage.
Q:When will the 48-bit timestamp in UUID v7 overflow?
A 48-bit millisecond integer can count up to 281,474,976,710,655 milliseconds from January 1, 1970, providing over 8,000 years of headroom.
13. Related Client-Side Verification Tools
Inspect, test, and benchmark these technologies directly in your browser with 100% private client-side execution:
References & Primary Sources
Every source below directly substantiates technical statements and protocol behaviors explained in UUID v4 (RFC 4122) vs UUID v7 (RFC 9562). Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.
- [1]IETFPrimary SpecificationRFC 9562 • Section 5 (UUID Versions 4, 7)Verified Primary SourceTechnical Claim Supported:
Defines 128-bit UUID generation formats, replacing RFC 4122 and standardizing Version 4 (random) and Version 7 (Unix epoch time-ordered) identifiers.
Source URI: https://datatracker.ietf.org/doc/html/rfc9562