What is a UUID?

UUID stands for "Universally Unique IDentifier" and refers to a standard for randomly generated, globally unique identifiers.

Example of an identifier (v4): 158c9998-18da-4bef-a8db-4891b1736574

Version 4 is the most commonly used. In this version, each identifier is randomly generated over 30 characters, with 2 characters reserved to store the version of the standard used: xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx

M contains the version code and N the sub-version identifier.

Why is this identifier increasingly used and particularly interesting? We'll find out together in the rest of this article.

Local vs global uniqueness

We're used to our identifiers being unique locally:

In SQL for example, we ensure that each primary key is unique in the table thanks to an index. The identifier is not random, but incremented from the last generated identifier, and unique locally (within each table).

Conversely, a UUID is "universally unique", and therefore has no controlling authority (index). Its uniqueness is ensured by the enormous number of possibilities during random generation.

How is that possible?

A UUID is composed of 128 bits, or 32 hexadecimal characters (4 bits per character). The number of possibilities for generating different UUIDs is therefore 5.31x10^36, more than the estimated number of bacteria present on Earth

As you'll have understood, since there is no control mechanism, the risk of collision (generation of two similar identifiers) cannot be zero:

Collision probabilities

With such a large number of possibilities as explained above, the risk of collision exists, but it is technically negligible.

According to Wikipedia: "To reach a 50% collision risk, you would need to generate 1 billion UUIDs per second for about 85 years. A file containing that many UUIDs would weigh 45 exabytes (45 billion GB)."

Nevertheless subject to what is called "entropy".

Entropy is a system's ability to generate random numbers that are very different from one another.

If entropy is too low, then the number of possible collisions is likely to increase drastically. This varies depending on the PRNG (Pseudo-Random Number Generation) algorithms.

As a reminder, absolute randomness does not exist in computing

For example, PRNG algorithms in web browsers often have too low an entropy to generate reliable UUIDs because they don't always have access to the operating system's algorithms, which are reliable enough for cryptographic operations.

The origin

Originally UUIDs were invented by the company Apollo Computer to uniquely identify RPC calls.

Remote Procedure Call: A protocol for executing methods on a remote machine.

Different versions

There are currently 5 different versions of the UUID standard, with version 4 being the most used.

Version 1, being designed to be transmitted over the network, contains at the beginning of the string the MAC address of the source machine and a timestamp.

This constraint ensured the uniqueness of the identifier (barring MAC address spoofing), but with the drawback of revealing private data about the machine.

Version 2 is a simple variant of V1, V3 is the equivalent of an md5 hash, and V5 of a SHA-1 hash.

It's with version 4 that the identifier becomes completely random and is used as a globally unique identifier, outside the context of the network.

There you have it, you now know everything there is to know about UUIDs.