UUID vs GUID - Same Thing? When to Use Each (2026)

If you have seen both "UUID" and "GUID" in documentation and wondered whether they are two different things, here is the short version: they are the same 128-bit identifier. GUID is Microsoft's name for it; UUID is the term used by the official standard and almost everyone else. This guide explains what they are, walks through the UUID versions with a focus on the random v4 you will use most, and shows exactly where they fit in databases, APIs, and testing.

UUID vs GUID: are they the same thing?

Yes. UUID (Universally Unique Identifier) and GUID (Globally Unique Identifier) refer to the same 128-bit value. The name GUID comes from the Microsoft world - .NET, SQL Server, COM, and the Windows registry all call it a GUID - while UUID is the name used in the formal specification (originally RFC 4122, updated by RFC 9562 in 2024) and in ecosystems like PostgreSQL, Java, Python, and JavaScript.

In day-to-day work you can treat the words as interchangeable. A GUID generated in C# and a UUID generated in Python have the identical format and can live in the same database column. The only differences you may hit are cosmetic: Microsoft tooling sometimes wraps the value in braces like {xxxxxxxx-...}, and historically a few Microsoft APIs stored parts of the value in a different byte order. The canonical text form is the same everywhere.

What a UUID/GUID looks like

A UUID is 128 bits, usually shown as 32 hexadecimal digits split into five groups separated by hyphens - the familiar 8-4-4-4-12 layout:

Two positions in that string are not random: the first digit of the third group encodes the version (the 4 above), and the first digit of the fourth group encodes the variant (usually 8, 9, a, or b). Everything else in a v4 UUID is random.

UUID versions overview

The standard defines several versions, each generated a different way. You rarely need more than one of them, but it helps to know what exists:

• v1 - time-based: built from the current timestamp plus the machine's MAC address. Sortable by creation time, but it can leak the MAC address and the moment it was created.
• v3 - name-based (MD5): a deterministic MD5 hash of a namespace plus a name, so the same input always produces the same UUID.
• v4 - random: 122 random bits. This is the default for most applications and the version this site's generator produces.
• v5 - name-based (SHA-1): like v3 but uses SHA-1; preferred over v3 when you need deterministic IDs.
• v6 / v7 / v8 - newer (RFC 9562, 2024): v7 is time-ordered and database-friendly, and is quickly becoming the recommended choice for new primary keys.

Version 4 is the workhorse. Its 122 bits of randomness make accidental collisions effectively impossible for any realistic number of IDs - you could generate billions per second for years and never expect a duplicate. Because it needs no central coordinator, any service, device, or test run can mint its own IDs offline.

When to use UUIDs (and when not to)

UUIDs shine whenever you need a unique identifier that can be created anywhere without asking a central authority.

Database primary keys

A UUID primary key lets you generate the ID in application code before the row is inserted, merge data from multiple databases without key collisions, and avoid exposing a guessable, sequential count of your records. The trade-offs are size (16 bytes vs 4-8 for an integer) and, for random v4, index fragmentation on large tables. If write performance matters, prefer a time-ordered v7 and store the value in a native uuid or binary column rather than as a 36-character string.

API resource and request IDs

Public-facing IDs in REST and GraphQL APIs are a great fit for UUIDs. They are non-sequential, so a client cannot guess /users/2 from /users/1, and each client or service can generate its own request IDs and idempotency keys locally without a round trip to the server.

Testing and fixtures

In automated tests, seed data, and load scripts, UUIDs give you collision-free identifiers without maintaining counters. Generate a fresh batch for each run so records never clash across parallel test suites.

Skip UUIDs when a simple auto-increment integer is enough - small internal lookup tables, or anywhere a short, human-friendly ID is more useful than global uniqueness. And never treat a UUID as a secret: a v4 UUID is unguessable, but it is an identifier, not a substitute for a signed token or a cryptographic key.

UUIDs in MongoDB, Java, and Python

Every major stack can generate and store UUIDs natively - here is the quick reference:

• MongoDB: the default _id is an ObjectId, not a UUID, but you can store a UUID in _id or any field using the BSON UUID (Binary subtype 4). Drivers expose helpers like UUID() so the value stays 16 bytes instead of a 36-character string.
• Java: java.util.UUID.randomUUID() returns a v4 UUID and UUID.fromString() parses one; Hibernate/JPA map it to a native uuid or binary(16) column.
• Python: the built-in uuid module gives you uuid.uuid4() for random IDs (plus uuid1 and uuid5); call str() for the text form or .bytes for the 16-byte value.
• .NET / C#: Guid.NewGuid() creates one and SQL Server's uniqueidentifier column stores it - this is the classic "GUID".
• JavaScript: crypto.randomUUID() generates a standards-compliant v4 UUID in modern browsers and Node.js, with no library required.

Frequently asked questions

Is a GUID the same as a UUID?

Yes. They describe the same 128-bit identifier. GUID is the name Microsoft uses in .NET, SQL Server, and Windows; UUID is the term in the official RFC standard and most other ecosystems. The format is identical, so a GUID and a UUID can be stored and compared interchangeably.

Which UUID version should I use?

Use version 4 (random) for general-purpose unique IDs - it is the most common and needs no coordination. If you are choosing primary keys for a large, write-heavy database, consider version 7, which is time-ordered and indexes more efficiently. Use v5 when you need the same input to always produce the same ID.

Can two UUIDs ever collide?

In theory yes, in practice no. A v4 UUID has 122 random bits, so the odds of generating a duplicate are astronomically small - you would need to create billions of UUIDs per second for many years before a collision became likely. For all practical purposes they are unique.

Are UUIDs secure or secret?

A random v4 UUID is effectively impossible to guess, but it is an identifier, not a credential. Do not use one as a password, session secret, or the only thing protecting a resource. Combine it with proper authentication and signed tokens wherever security matters.

Why does my GUID have curly braces?

Microsoft tools often display or store GUIDs wrapped in braces, like {3F2504E0-4F89-41D3-9A0C-0305E82C3301}, and sometimes in uppercase. The braces and case are just formatting - strip the braces and lowercase the value to get the canonical UUID form used everywhere else.