A UUID is a 128-bit identifier you can generate anywhere, with no central registry, and still trust to be unique. But not all UUIDs are built the same way. This guide explains the five versions you'll actually encounter, why v7 is winning for database keys, how namespace UUIDs stay deterministic, and just how unlikely a collision really is.

v4 vs v7 — random vs time-ordered

Version 4 is 122 bits of pure randomness, which makes it the simplest and most widely supported UUID. Its weakness shows up at scale: because the values are unordered, inserting v4 keys into a database index scatters writes across the whole B-tree, causing page splits and cache misses.

Version 7 fixes this by placing a 48-bit Unix-millisecond timestamp in the high bits. The result still has plenty of randomness for uniqueness, but consecutive UUIDs share a leading prefix, so new rows append near each other. That keeps indexes compact and inserts fast — which is why v7 is increasingly the default for new primary keys.

Namespace UUIDs (v5 and v3)

Versions 5 and 3 are deterministic. You give them a namespace UUID and a name; they concatenate the bytes and hash them — SHA-1 for v5, MD5 for v3 — then carve a UUID out of the digest. The same inputs always produce the same UUID, which is perfect for deriving a stable ID from something you already have, like a URL or a file path.

Prefer v5 over v3: SHA-1 is stronger than MD5, and v3 exists mainly for compatibility with older systems. RFC 4122 ships four standard namespaces (DNS, URL, OID, X.500), and you can define your own by supplying any UUID as the namespace.

How likely is a collision?

With 122 random bits, version 4 draws from about 5.3 × 1036 possible values. Using the birthday-problem approximation, you would need to generate roughly 2.71 × 1018 (2.71 quintillion) UUIDs before reaching even a 50% chance of a single collision — about a billion UUIDs every second for 85 years.

v7 carries fewer random bits (74) but scopes them to a single millisecond, so the practical collision risk only matters if you generate enormous volumes within the same millisecond on the same machine. For virtually every application, both versions can be treated as collision-free.