UUID v4 vs v7: Which Should You Use

UUID v4 is fully random; UUID v7 starts with a timestamp so it sorts by creation time. Compare them for database keys, privacy and what each one reveals.

· 3 min read

UUIDs are 128-bit identifiers that you can generate anywhere without coordinating with a server. Version 4 has been the default for years. Version 7, standardized in RFC 9562, keeps the same format but changes what the bits mean, and that difference matters most when the UUID is a database key.

Generate either version below and compare them.

UUID GeneratorGenerate UUIDs in your browser, either random v4 or time-sortable v7. Choose how many you need and copy them individually or all at once.

How each version is built

UUID v4UUID v7
Source of bitsRandom48-bit Unix timestamp in milliseconds, then random
Random bits12274
Sorts by creation timeNoYes
Reveals creation timeNoYes
First digit of the third group47
v4  f47ac10b-58cc-4372-a567-0e02b2c3d479
v7  0190a1b2-c3d4-7e5f-8a6b-7c8d9e0f1a2b

The version digit is the first character of the third group. In v7, the first 12 hex digits are the timestamp, which is why consecutive v7 values share a prefix and sort in order.

Why v7 is better for database keys

Most databases store primary keys in a B-tree index. Random v4 values land in random places in that tree, so inserts constantly touch scattered pages, cause page splits and hurt cache locality. Because v7 values increase over time, new rows are appended near the end of the index, like an auto-increment integer, while you still get globally unique IDs generated on the client.

This effect is mostly visible on large tables with heavy write rates. On a small table, either version is fine.

When v4 is still the right choice

  • You do not want to leak timing. A v7 value reveals when the record was created to the millisecond. If IDs are exposed in URLs or APIs and creation time is sensitive, v4 is the safer choice.
  • You need maximum unpredictability. v4 has more random bits and no structure.
  • Your environment lacks v7 support. Check your database and language libraries before assuming it exists; fall back to v4 when in doubt.

What neither version is for

A UUID is an identifier, not a secret. Do not use one as a password-reset token, API key or session secret simply because it looks random. For secrets, generate bytes from a cryptographically secure random source and encode them directly.

A quick decision guide

  1. Is the ID a primary key in a large, write-heavy table? Prefer v7.
  2. Will the ID be public and creation time must stay private? Use v4.
  3. Need a secret value rather than an ID? Use neither; use secure random bytes.
  4. Unsure? v4 is the safe, universally supported default.

For other random values, such as numbers in a range, the random number generator covers that.

Random Number GeneratorGenerate random numbers in any range, as integers or decimals, with an option for no repeats. Draws come from the browser cryptographic random source rather than Math.random.

Try the tools

UUID GeneratorGenerate UUIDs in your browser, either random v4 or time-sortable v7. Choose how many you need and copy them individually or all at once.Random Number GeneratorGenerate random numbers in any range, as integers or decimals, with an option for no repeats. Draws come from the browser cryptographic random source rather than Math.random.