Can a UUID v4 ever collide?

Yes. With a good random source, even among one trillion UUIDs, the chance of an accidental match is about one in 11 trillion.

Here's why repeats are possible, and what that means for the IDs you use.

FluffyBench · 5 min read · Reviewed October 15, 2026

What part of a UUID v4 is random?

A UUID is a label for something in an app, such as a customer record or a request. Think of a coat-check ticket: its printed marks tell staff how to read it, while the changing number tells them which coat is yours. Version 4 makes the changing part at random, so separate computers can make labels without sharing a counter.

A UUID v4 has 122 random bits—yes-or-no choices—and 6 bits that mark its format. Here's the recorded UUID 80939bb4-d9b8-40da-9f73-21578b3522c2, with those markers picked out.

The UUID 80939bb4-d9b8-40da-9f73-21578b3522c2 split into groups: 4 marks version 4; the 9 expands to binary 1001, with 10 fixed for the variant and 01 chosen at random. The complete UUID has 122 random bits and 6 fixed bits. — The version digit is always 4; the variant digit can be 8, 9, a or b because part of it is random. Sources and review notes

Those familiar hyphens help you read the label. They don't add randomness, and the format markers don't describe the customer, request, or device that made it.

Why can two UUID v4s match?

A random choice can repeat. The generator doesn't cross an ID off a shared list after it's used. Two computers can therefore pick the same value, even though neither has seen what the other made. That exact repeat is called a collision.

Each new label could match any label you've already made. Connecting every possible pair shows why the chance grows as the group grows.

Illustration: labels A, B and C have three possible pairs. Adding label D adds the pairs A–D, B–D and C–D, giving six pairs in total. Lines mark comparisons, not actual matches. — Each line is a possible matching pair; adding one label adds several chances to match.

That's the idea behind the birthday puzzle: you're looking for any two people with the same birthday, not someone with your particular birthday. With UUIDs, the pool of choices is vastly larger. A collision can happen before you've used every choice; filling the pool isn't the condition for a repeat.

How small is the UUID v4 collision risk?

Assume each UUID is a fresh choice, independent of the others, with every possible value equally likely. These calculated odds are for any matching pair in the whole group.

Collision chance on a logarithmic probability scale: one million UUIDs: about 1 in 11 septillion; one billion: about 1 in 11 quintillion; one trillion: about 1 in 11 trillion. The dots move toward higher probability as more UUIDs are generated. — Calculated group-collision odds—one million UUIDs: about 1 in 11 septillion; one billion: about 1 in 11 quintillion; one trillion: about 1 in 11 trillion.

Even with one trillion UUIDs, the chance of any match is about one in 11 trillion. That's why version 4 works well when different parts of an app need to make IDs without coordinating each choice.

These odds come from a probability calculation. How we reviewed separates that calculation from the recorded generator check.

What should an app do with UUID v4 IDs?

Use a cryptographic random source to make UUIDs. FluffyBench's UUID generator uses Web Crypto, the browser's built-in source for security work.

Inside the browser, FluffyBench's UUID generator asks Web Crypto for a UUID v4. Separately, an app that requires unique IDs enforces uniqueness on every save: a new ID is saved, and an existing ID is rejected. — Generation makes a candidate ID; the app's uniqueness rule decides whether it can be saved.

If your records must have different IDs, enforce that rule on every save, for example with a database unique constraint. A separate check before saving can miss two requests arriving together. The constraint prevents them from both storing the same ID; handling an actual random collision should be rare.

Does knowing a UUID give someone access?

An ID names a record; it doesn't grant permission to open it. A UUID can appear in a link, a log, or a message, so the app needs its own access check.

Two people request the same UUID-labelled record. The app's permission check allows the record's owner and denies someone without permission, even though both know the UUID. — The same record ID leads to different answers when the people asking have different permissions.

Doing it in FluffyBench

Here's how to make five IDs with FluffyBench's UUID generator and take the list with you.

Step 1. Choose five IDs and the spelling your app expects.
1. How many sets the batch size; enter 5.
2. Letters changes case; leave lowercase selected.
3. Keep the hyphens adds separators; leave it checked.
Step 2. Press Generate 5 new UUIDs to make a fresh batch.
1. Generate makes five fresh IDs.
Step 3. Check that the result contains five IDs in the spelling you chose.
1. Each row is one new UUID.
Step 4. Copy the list, or save it as uuids.txt.
1. 5 UUIDs confirms the result count.
2. Copy all puts one ID per line on your clipboard.
3. Download .txt saves one ID per line.

Need FluffyBench's UUID generator to make IDs for your app?

FluffyBench's UUID generator

Make fresh version 4 IDs and copy the list into your app.

How we reviewed

Reviewed October 15, 2026

Format and randomness guidance: RFC 9562 sections 4.1, 4.2 and 5.4, RFC 9562 section 6.9, and MDN Web Crypto documentation. The recorded correctness sample used Node.js Web Crypto on October 15, 2026, on AMD Ryzen 9 5950X, Windows 11 Pro. It contained 10,000 distinct, correctly formatted values among 10,000 generated UUIDs.

This guide reports no runtime measurement. The sample checks format and duplicates in that batch; the collision probabilities come from a separate mathematical model. RFC 9562 supplies the UUID layout and randomness guidance, not the birthday equation used here.

For n values in a space of 2^122 choices, let λ = n(n−1)/(2 × 2^122). At small probabilities, p ≈ λ; the three plotted values use that small-probability approximation. The exponential birthday approximation is p ≈ 1 − exp(−λ). At 2.7e+18 values, λ is 68.6%, while 1 − exp(−λ) is 49.6%, about half. The small-probability expression cannot be used as the probability at that scale.

A generator that reuses a random sequence can repeat IDs much sooner than the model predicts. Web Crypto is the source used here: crypto.randomUUID(), or crypto.getRandomValues() with the version and variant bits set. Math.random() isn't a cryptographic random source.

The generator accepts whole-number counts from 1 through 100. The walkthrough is a fresh UI capture for illustration, separate from the recorded correctness sample; it generates five UUIDs with lowercase letters and hyphens. Copy all separates values with newlines; Download.txt saves uuids.txt with one UUID per line.

The diagrams are first-party illustrations, not additional experiments. The probability dots share a logarithmic scale; their positions and labels are derived from the existing collision examples. The connected labels illustrate comparisons, not observed collisions.