UUID v4 vs UUID v7: Which Random Identifier Should You Generate?
UUID v4 is a randomly or pseudorandomly generated UUID, while UUID v7 is a Unix-epoch-time-based UUID with random data and optional monotonicity fields.
A worked example with numbers
A log system creates three records at 12:00:00.100, 12:00:00.250, and 12:00:01.000 UTC. Properly encoded v7 values place the 48-bit millisecond timestamps first, so bytewise order generally follows those milliseconds across the three times. Three v4 values have no such time ordering: sorting them orders random bytes. Both formats are 128 bits, but the first 48 v7 bits describe time rather than adding random choice.
How to set the rule before the result
Use the UUID generator only after confirming which versions the receiving system accepts. Choose v4 for ordinary opaque random identifiers. Choose v7 for storage or indexing patterns that benefit from chronological order, then document UTC handling, same-millisecond generation, and whether the visible timestamp is acceptable to reveal.
Common mistakes that change the odds or the process
Do not expect v7 string order to prove exact event order within the same millisecond unless the implementation’s monotonicity behaviour is documented. Do not describe v4 as time-ordered. Do not use either UUID version as a password, bearer token, or authorisation decision merely because it includes random bits. Do not silently substitute v7 into an API that validates only v4.
Where this method stops being appropriate
Version choice is a data-model decision. Neither format establishes the truth of an event time, handles clock errors, guarantees privacy, or replaces a database constraint. A distributed system needs its own ordering, clock, and conflict policies around the identifier.
How the random source fits into the rule
IETF RFC 9562 defines v4 as randomly or pseudorandomly generated and v7 as Unix Epoch time-based. It specifies v7’s 48-bit millisecond timestamp and 74 random or optional monotonicity bits, which is why v7 can help ordering while v4 retains more random payload bits.
Check the actual population and denominator
A log system creates three records at 12:00:00.100, 12:00:00.250, and 12:00:01.000 UTC. Properly encoded v7 values place the 48-bit millisecond timestamps first, so bytewise order generally follows those milliseconds across the three times. Three v4 values have no such time ordering: sorting them orders random bytes. Both formats are 128 bits, but the first 48 v7 bits describe time rather than adding random choice.
Set the rule before an output exists
Use the UUID generator only after confirming which versions the receiving system accepts. Choose v4 for ordinary opaque random identifiers. Choose v7 for storage or indexing patterns that benefit from chronological order, then document UTC handling, same-millisecond generation, and whether the visible timestamp is acceptable to reveal.
Keep a different process from slipping in
Do not expect v7 string order to prove exact event order within the same millisecond unless the implementation’s monotonicity behaviour is documented. Do not describe v4 as time-ordered. Do not use either UUID version as a password, bearer token, or authorisation decision merely because it includes random bits. Do not silently substitute v7 into an API that validates only v4.
Limit the conclusion to this stated case
Version choice is a data-model decision. Neither format establishes the truth of an event time, handles clock errors, guarantees privacy, or replaces a database constraint. A distributed system needs its own ordering, clock, and conflict policies around the identifier.
Name the source behind the numerical claim
IETF RFC 9562 defines v4 as randomly or pseudorandomly generated and v7 as Unix Epoch time-based. It specifies v7’s 48-bit millisecond timestamp and 74 random or optional monotonicity bits, which is why v7 can help ordering while v4 retains more random payload bits.
Compare the formats by their visible trade-off
| Property | UUID v4 | UUID v7 |
|---|---|---|
| Time field | None | 48-bit Unix milliseconds |
| Random or monotonicity bits | 122 | 74 |
| Natural chronological byte order | No | Across different milliseconds |
The v7 timestamp can make storage order useful but can also reveal approximate creation time. That visibility is a product decision, not an implementation accident.
Check same-millisecond behaviour
Several v7 values may share one millisecond timestamp. RFC 9562 permits random data and optional counters or sub-millisecond methods for additional monotonicity, so inspect the generating library’s documented behaviour before treating sorted IDs as an exact event sequence.
Make migration and interoperability explicit
A database can store both versions as 16-byte UUID values, but clients, validators, and library defaults may reject an unfamiliar version. Test parsing, serialization, indexes, and sort order with real v7 samples before changing a production contract. If an external interface promises v4, preserve that promise or version the interface. Identifier format is part of compatibility, not a cosmetic detail.
Consider timestamp disclosure before choosing v7
The leading v7 timestamp encodes milliseconds since the Unix epoch, so a person who can parse an identifier can infer approximately when it was created. That can be helpful for operational debugging and ordered indexes. It can be undesirable in public URLs, where creation timing itself is sensitive. V4 does not put that timestamp in its defined fields. Decide on that privacy trade-off explicitly, and do not assume the random tail of v7 hides the time component.
Keep test fixtures versioned as well: an example v4 does not test a v7 parser, and a v7 timestamp sort does not test the behaviour of an opaque v4 identifier.