UUID v4 structure, randomness, and collisions

Short answer

A UUID v4 is a 128-bit identifier generated mostly from random bits. Its common text form contains 32 hexadecimal digits in groups:

xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx

The 4 fixes the version. The high bits of y identify the format variant. After reserving those fields, 122 random bits remain.

Reading an example

550e8400-e29b-41d4-a716-446655440000
              ^    ^
           version variant

RFC 9562 defines UUID v4 and replaces the historical RFC 4122 specification. The UUID v4 generator uses the browser’s cryptographic random source and sets the version and variant bits.

Collision probability

UUIDs do not provide mathematical proof of uniqueness. With uniform generation, the approximate probability of at least one collision among n values, while n remains small relative to the space, is:

n² / (2 × 2^122)

Even at one billion UUIDs, the approximation is about 9.4 × 10^-20. A broken implementation or weak random source is usually a more practical concern than ideal random collision.

What UUID v4 does not guarantee

• It does not sort chronologically.
• It does not hide information or act as a password.
• It does not prove who created the identifier.
• It does not replace a unique database constraint when the application must detect collisions.

Generate UUIDs in an environment with secure randomness, use one consistent canonical case, and validate the version and variant when your contract specifically requires v4.