100% ブラウザ内完結計算 • サーバーログ完全ゼロ • 即時実行
Curious Techie開発者ツールボックス
Cryptography & Data EncodingRFC 9562 (replaces RFC 4122)6 min ReadDirect Definition • Curious-Techie

What Is a UUID?

Universally Unique Identifier — Architectural definition, operational mechanics, real-world examples, security posture, and client-side inspection utilities.

CT
Curious-Techie Engineering Team認証著者

Web Protocols & Security Architecture Research

公開日:
•
更新日:
•6 min
準拠仕様:RFC 9110(IETF)
査読者: Curious-Techie Architecture Peer Review Group
Primary Question • Immediate Technical Answer

What Is a UUID?

Supporting Architectural Explanation

A UUID is formatted as a 36-character canonical string consisting of 32 hexadecimal digits displayed in five hyphen-separated groups: `8-4-4-4-12` (e.g. `f47ac10b-58cc-4372-a567-0e02b2c3d479`).

While UUID version 4 is generated using 122 bits of pure cryptographic pseudo-randomness, modern architectures increasingly adopt UUID version 7, which combines a 48-bit Unix millisecond timestamp with random data to provide time-ordered sorting and optimize B-Tree database indexing.

Secondary Question • Origins & Motivation

Why does UUID exist?

直接の回答(AEO要約):

Allows any client or server anywhere in the world to autonomously generate an ID guaranteed to be unique across all space and time with zero network coordination.

Historical Context & Genesis

Traditional relational databases relied on auto-incrementing sequential integers (`id=1, 2, 3...`). In distributed, multi-datacenter, or offline-first microservices, two independent database nodes would assign the identical ID to different records, causing catastrophic database collisions during replication.

Core Architectural Problem Solved

Allows any client or server anywhere in the world to autonomously generate an ID guaranteed to be unique across all space and time with zero network coordination.

Secondary Question • Architecture & Flow

How does UUID work?

Direct Answer:

A system reads a cryptographically secure random number generator (and optionally the current timestamp), sets specific version and variant bits according to RFC 9562, and formats the 16 bytes into hex groups.

1

Random / Timestamp Acquisition

For UUID v4: 16 cryptographically random bytes are generated. For UUID v7: first 6 bytes hold 48-bit Unix timestamp.

2

Version Bit Injection

Bits 48-51 are overwritten with the version number (e.g. `0100` for v4, `0111` for v7).

3

Variant Bit Injection

Bits 64-65 are set to `10` to designate the standard RFC 4122 / RFC 9562 variant.

4

Canonical Formatting

128 bits are rendered into lowercase hexadecimal: `xxxxxxxx-xxxx-Vxxx-Axxx-xxxxxxxxxxxx`.

Technical Examples • Implementation

How is UUID implemented in code?

Generating UUID v4 and Modern Time-Ordered UUID v7javascript
// 1. Browser Native Web Crypto API (UUID v4)
const uuidV4 = crypto.randomUUID();
console.log("UUID v4:", uuidV4);
// "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d"
// Notice: 13th char is '4' (version), 17th char starts with [8,9,a,b] (variant)

// 2. Modern UUID v7 (Time-Ordered for Fast Database Indexing)
// Byte breakdown: [48-bit timestamp ms] + [version 7] + [random bits]
function generateUuidV7() {
  const timestamp = BigInt(Date.now());
  const randomBytes = crypto.getRandomValues(new Uint8Array(10));
  
  // High 48 bits: Unix timestamp in ms
  const timeHex = timestamp.toString(16).padStart(12, '0');
  
  // Format into canonical groups with version 7 and variant 2
  return `${timeHex.slice(0, 8)}-${timeHex.slice(8, 12)}-7${randomBytes[0].toString(16).slice(0,1)}${randomBytes[1].toString(16).padStart(2,'0')}-${((randomBytes[2] & 0x3f) | 0x80).toString(16).padStart(2,'0')}${randomBytes[3].toString(16).padStart(2,'0')}-${Array.from(randomBytes.slice(4)).map(b => b.toString(16).padStart(2,'0')).join('')}`;
}

Architectural Explanation: UUID v4 provides maximum entropy; UUID v7 provides monotonic time-ordering to eliminate database B-Tree index fragmentation.

Production Context • System Architecture

Where is UUID commonly used?

Database Primary Keys

Identifying user accounts, transaction IDs, and orders across sharded database tables.

Idempotency Keys in Payment APIs

Preventing duplicate charges in Stripe by passing a unique UUID per transaction attempt.

Distributed Tracing & Correlation IDs

Tracking a single user request across hundreds of microservices via `X-Correlation-ID: <uuid>`.

Architectural Trade-Offs • Pros & Cons

What are the advantages and limitations of UUID?

Core Advantages

Zero Coordination Required

Mobile apps can generate IDs offline without asking the database for the next sequential integer.

Incredible Collision Resistance

With $2^{122}$ random states in v4, generating 1 billion UUIDs per second for 100 years yields near-zero collision probability.

Security Through Unpredictability

Prevents enumeration attacks where attackers scrape records by guessing sequential IDs (`/user/1`, `/user/2`).

Architectural Limitations

Storage & Memory Size

Takes 16 bytes in binary or 36 bytes as a string, compared to just 4 bytes for standard 32-bit integers.

B-Tree Index Fragmentation (v4)

Random UUID v4 causes random disk writes in database B-Trees (solved by time-ordered UUID v7).

Risk Analysis • Attack Vectors

Can UUID introduce security vulnerabilities?

Threat Vector

Predictable UUID Generation (Math.random)

Using insecure random number generators (`Math.random()`) allows attackers to predict reset tokens or API resource IDs.

Recommended Mitigation:

Always use CSPRNGs like `crypto.randomUUID()` or `crypto.getRandomValues()`.

Myths vs Reality • Technical Clarification

What are common misconceptions about UUID?

Myth / Fallacy
"UUID collisions are a common risk developers need to write retry loops for."
Technical Reality

The probability of two UUID v4 values colliding is so infinitesimally small that it is practically impossible in any realistic application.

Secondary Questions • Direct Technical Answers

Frequently Asked Questions About UUID

Q:Why is UUID v7 replacing UUID v4 for database primary keys?

直接の回答(AEO要約):UUID v4 is completely random, which causes severe B-Tree index fragmentation and slow disk page splits in databases like PostgreSQL and MySQL. UUID v7 prefixes a millisecond timestamp, making IDs naturally sortable by creation time and speeding up database inserts by up to 500%.

RFC 9562 formally standardized UUID v7 in 2024 as the modern replacement for database primary keys.

12. Related Interactive Tools

Inspect, test, and verify this protocol directly in your browser with 100% private client-side execution:

Companion Interactive Tool100% Client-Side Execution

Test & Verify with UUID / GUID Generator

Generate cryptographically random UUID v4 and time-ordered UUID v7.

Companion Interactive Tool100% Client-Side Execution

Test & Verify with Cryptographic Hash Generator

Generate SHA-256, SHA-384, SHA-512, SHA-1, and MD5 hashes locally.

Authoritative Sourcing & Verification

References & Primary Sources

Every source below directly substantiates technical statements and protocol behaviors explained in Universally Unique Identifier (UUID). Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.

  1. [1]IETFPrimary SpecificationRFC 9562 • Section 5 (UUID Versions 4, 7)
    Verified Primary Source
    Technical Claim Supported:

    Defines 128-bit UUID generation formats, replacing RFC 4122 and standardizing Version 4 (random) and Version 7 (Unix epoch time-ordered) identifiers.