A version-four identifier has fixed and random bits
A UUID v4 starts with 16 random bytes, then sets four version bits to 0100 and two variant bits to 10. The familiar 36-character form therefore contains hyphens and a fixed 4 in the third group; those characters are format markers, not evidence that the identifier was copied. After the fixed bits, 122 bits remain random.
Checking an example structurally
Consider 550e8400-e29b-41d4-a716-446655440000. It has five hexadecimal groups of 8-4-4-4-12 characters, the first character of group three is 4, and the first character of group four is 8, 9, a, or b. Those checks establish v4 formatting. They do not prove that the value was generated securely or that no database already contains it.
Collision risk is about population size
For about one billion independently generated v4 UUIDs, the birthday approximation gives a collision probability near n²/(2 × 2^122), roughly 9.4 × 10^-20. That is tiny for ordinary identifiers, but it is not mathematical impossibility. A database should still enforce uniqueness and handle a duplicate insertion rather than treating a UUID as authorization.
Identifiers are not secrets or timestamps
A v4 UUID does not encode creation time, a person’s identity, sorting order, or permission to access an object. Do not use a visible UUID alone as an access-control token, and do not infer chronology from its hexadecimal characters. Systems needing sortable IDs or cryptographic capabilities require a different specification.
Validate at the system boundary
Applications should parse the hyphenated hexadecimal form and reject malformed values before storing them. They should also perform the database uniqueness check at insertion time, because two clients can generate values independently. Format validation answers 'does this look like a v4 UUID?'; the database constraint answers 'is this identifier unused here?'.
Keep identifier scope explicit
A UUID can be convenient for records, URLs, and client-side creation because independent clients are unlikely to collide. It should still be scoped by the application that owns it. The same string in two unrelated systems does not establish a relationship, provenance, or permission between their records.
Questions about UUID v4 format
What makes this UUID version 4?
Its version and variant bits are set to the v4 pattern.
Does a UUID grant access?
No, an identifier is not an authorization mechanism.
Continue with another technical utility
All text and idea generators · Random Password Generator · Decision Matrix Tie Breaker