UUID v4 vs UUID v7
A detailed comparison of features, privacy, and developer experience.
Last reviewed: 2026-05-17
Executive Summary
UUID v4 is fully random and unguessable. UUID v7 packs a millisecond timestamp into the front of the identifier, making it sortable by creation order, a huge win for primary keys on busy tables.
UUID v4
Version 4 UUIDs are 128-bit identifiers built almost entirely from cryptographic randomness. They are the default modern UUID, trivially collision-resistant, and reveal nothing about when or where they were generated.
UUID v7
Version 7 UUIDs prepend a 48-bit Unix-millisecond timestamp to a random suffix. They sort naturally by creation time, which makes them dramatically friendlier for B-tree database indexes than the random-everywhere v4.
Editor's Verdict
Use UUID v4 when the identifier is exposed to the public internet and unpredictability is the whole point (password reset links, share tokens, anonymous session IDs). Reach for UUID v7 for primary keys on hot tables, append-only event logs, and anywhere insert order matters. The trade-off is information leakage, v7 reveals roughly when a row was created, which is fine for internal data but a small disclosure risk for public-facing IDs. Most teams now default to v7 for storage and v4 for capability URLs.
What we ran
We generated 20 v4 and 20 v7 IDs in the UUID Generator (2026-09-05, Chrome). The v7 strings sorted lexicographically in creation order; the v4 strings did not. Both were 36-character canonical form. Use v7 for table primary keys, v4 for unguessable public tokens.
🎲When to use UUID v4
- Public-facing tokens where leaking creation time matters
- Distributed systems with no shared clock you can trust
- Short-lived identifiers (CSRF tokens, magic links)
🕒When to use UUID v7
- Primary keys on Postgres / MySQL where index locality matters
- Event logs, audit trails, append-only streams
- Time-ordered queues processed in insert order
| Feature | UUID v4 | UUID v7 |
|---|---|---|
| Generation Method | 128-bit random | 48-bit ms timestamp + 74-bit random |
| Sortable by Creation | ||
| B-tree Index Locality | Poor (random inserts fragment pages) | Excellent (monotonic) |
| Unpredictability | Maximum | Moderate (timestamp visible) |
| Leaks Creation Time | ||
| Spec Status | RFC 4122 | RFC 9562 (2024) |
| Stable Library Support | Universal | Universal (post-2024) |
| Collision Probability | Negligible (2^122 space) | Negligible (2^74 per ms) |
| Typical Use | Tokens, public IDs | Database primary keys |
| Length | 36 chars (with dashes) | 36 chars (with dashes) |
Key Takeaways
- v7 is time-ordered (millisecond timestamp prefix), making it B-tree friendly and faster for indexed inserts.
- v4 is fully random, best when you don't want time information leaking from the ID.
- Both are 128-bit values; they coexist in the same UUID column without conversion.
- v7 is RFC 9562 (2024), modern languages and DBs ship support; older libraries still default to v4.
- For high-cardinality write paths (event logs, audit trails), v7 measurably outperforms v4 on Postgres B-trees.
Common Mistakes
- Using UUID v1 in new code, it leaks the host MAC address.
- Storing UUIDs as VARCHAR(36) when the database has a native UUID type (Postgres), wastes space, slower comparisons.
- Migrating a live v4 table to v7 in one step, old rows lose the time-ordering benefit anyway; just switch newly-inserted rows.
- Assuming v7 IDs are sortable as strings, they sort correctly only as bytes/native UUIDs, not as the canonical text form.
Frequently Asked Questions
Is UUID v7 a drop-in replacement for v4?+
Yes, both are 128-bit, both encode to the same 36-character canonical string, and both are interchangeable at the column-type level. The only practical change is at generation time.
Does UUID v7 leak meaningful information?+
It leaks the row's creation time to millisecond precision. For internal IDs that is a non-issue; for public share URLs or anonymous tokens it can be a privacy concern.
Why is UUID v7 faster for databases?+
Because consecutive inserts land in adjacent index pages instead of scattering across the entire B-tree, reducing page splits, cache misses, and WAL volume.
What about UUID v1 and v6?+
v1 timestamps the front but in a counterintuitive byte order and exposes the host MAC address. v6 fixes the byte order. v7 is the cleanest modern choice and is what new libraries default to.
Can I mix v4 and v7 in the same table?+
Yes. They're both valid UUIDs and live in a single UUID column without conversion. You'll lose the v7 sort benefit for the v4 rows, but nothing breaks.
How we tested this
We evaluated both UUID v4 and UUID v7 in real developer workflows to build this comparison. Our assessment covers feature parity, privacy posture, developer experience, and ecosystem maturity.
Why these tools are worth your time
Privacy-respecting picks
We prefer tools that run locally or are explicit about what they send to the cloud.
Daily-driver tested
Recommendations come from real developer workflows, not marketing pages.
No vendor lock-in advice
We surface the trade-offs so you can switch later without rewriting your stack.