UUID Bulk Generator

Version 4 is random, and that is usually right

A v4 UUID is 122 random bits, giving about 5.3 times 10 to the 36 possible values. The collision probability is negligible for any realistic volume: generating a billion per second for a century leaves the chance of one collision well under a percent, assuming a sound random source. That last clause matters — a UUID built from a weak or unseeded generator loses the guarantee entirely, which is why UUIDs from a poorly seeded runtime occasionally do collide in practice.

Random UUIDs are hostile to database indexes

Inserting random values into a B-tree primary key scatters writes across the whole index rather than appending to the end. Pages split, the index fragments, and the working set stops fitting in memory. On InnoDB, where the primary key determines physical row order, this is measurably worse than an auto-increment key at scale. The problem is not UUIDs; it is randomness in a clustered key.

Version 7 fixes exactly that

UUIDv7 puts a millisecond timestamp in the leading 48 bits, followed by random bits. Values therefore sort chronologically and new inserts land at the end of the index, restoring append-like behaviour while keeping the uniqueness and unguessability that made UUIDs attractive. For new systems choosing a UUID primary key, v7 is now the sensible default. It also leaks creation time, which is occasionally a consideration.

Version 1 and its history

UUIDv1 combines a timestamp with the machine's MAC address. It sorts poorly because the timestamp bytes are ordered oddly, and it discloses the generating host's hardware address, which has appeared in real incident reports. Version 7 supersedes it for every purpose.

Storage format is worth deciding early

A UUID is 16 bytes. Stored as a 36-character string it takes 36 bytes and compares character by character; stored as binary(16) it takes 16 and compares as an integer. Across a large table with foreign keys, the difference is substantial in both space and index performance. Converting later means rewriting every referencing column.

Unpredictable is not the same as secret

A v4 UUID is unguessable enough to serve as an opaque identifier in a URL, but it is not an authentication token. It appears in logs, referrer headers and browser history, and it never expires. Anything protecting access needs a purpose-built token with a lifetime and a revocation path.