Architecture and Mathematical Foundation of UUID Version 4
Standard Reference: IETF RFC 4122 ยง4.4 / RFC 9562 ยง5.4
Structural Bit Layout (128 Bits Total)
A Universally Unique Identifier (UUID) Version 4 is a 128-bit integer rendered as 32 hexadecimal
characters separated into five groups by four hyphens: xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx.
time_low segment populated purely with CSPRNG entropy.
time_mid segment filled with random hardware bytes.
First nibble is fixed at binary 0100 (Version 4).
First nibble is masked to 10xx (RFC 4122 variant).
node field replaced entirely with random cryptographic bytes.
Collision Probability & Mathematical Security
Because 6 of the 128 total bits are dedicated to standard metadata (4 version bits and 2 variant bits), exactly 122 bits consist of unconstrained, hardware-seeded cryptographic randomness. The total pool of possible Version 4 UUID combinations is:
According to the cryptographic Birthday Paradox, the probability $P$ of encountering at least one collision after generating $n$ unique Version 4 UUIDs is approximated by:
| UUIDs Generated | Collision Probability | Real-World Comparative Scale |
|---|---|---|
| 1 Billion (10โน) | โ 1 in 10ยฒโท (0.0000000000000000000000001%) | Virtually zero; lower odds than being struck by lightning 10 times in a single day. |
| 1 Trillion (10ยนยฒ) | โ 1 in 10ยฒยน | Exceeds the total number of transactions processed across global financial networks annually. |
| 2.71 Quintillion (2.71 ร 10ยนโธ) | โ 50% (Statistical Threshold) | Generating 1 billion UUIDs per second continuously for 85 consecutive years. |
When to Deploy UUID v4 vs. UUID v7
โ When to use UUID v4
- Stateless Security Tokens: Password reset tokens, session tokens, and webhook secrets where unpredictable entropy prevents brute-force enumeration.
- Anti-Enumeration IDs: Public-facing resource identifiers where leaking creation timestamps (such as in UUID v7) exposes business telemetry.
- In-Memory Distributed Maps: Ephemeral task IDs and event message correlations.
โ ๏ธ When to consider UUID v7 instead
- SQL Database Primary Keys: High-throughput PostgreSQL, MySQL, or SQLite tables where random v4 inserts trigger B-Tree index page splits.
- Time-Ordered Logs: Event audit logs where natural chronological sorting optimizes range scan performance.