UUID vs ULID vs Token Identifier Guide
UUID, ULID and random tokens are the three most common identifier types for developers. This guide compares their format, length, sortability and typical use cases so you can choose the right fit for database keys, API keys and session IDs.
How It Works
Identifiers balance two seemingly conflicting goals: global uniqueness and sortability/predictability. Early UUID v4 is purely random — unique but leaks no time and is not sortable. When databases need insertion-order scans (to avoid B-tree page splits), time-prefixed schemes appeared: UUID v7 (first 48 bits = Unix ms timestamp) and ULID (first 48 bits = Crockford Base32 timestamp).
Tokens differ in purpose from UUIDs: a UUID is designed for uniqueness and fits primary/object keys; secrets like API keys, sessions and activation codes should prefer cryptographically secure random tokens, with length, alphabet and prefixes (e.g. sk_live_) scoped by permission. Base58 / Base62 drop visually confusing characters (0/O, I/l) for safer manual entry.
| Identifier | Format | Length / Entropy | Sortable | Best For |
|---|---|---|---|---|
| UUID v4 | xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx | 122 random bits + 6 version/variant bits | No (fully random) | Database keys, distributed IDs, privacy-sensitive IDs |
| UUID v7 | Timestamp (48 bits) + random (74 bits) | 128 bits | Yes (monotonically increasing by time) | New systems needing sortable primary keys |
| ULID | TTTTTTTTTTRRRRRRRRRRRRRRRR (Crockford Base32) | 48-bit timestamp + 80-bit randomness | Yes (lexicographically sortable by generation time) | URL-safe, sortable, human-readable identifiers |
| Random Token | Hex / Base64 / Base62 string | As needed (commonly 128–256 bits) | No | API keys, sessions, activation codes, invite codes |
Frequently Asked Questions
Can UUIDs collide?
UUID v4 collision probability is negligible: you would need to generate roughly 10^18 122-bit random UUIDs before expecting a single collision, far beyond normal business scale. UUID v7 and ULID add a time prefix; IDs generated in the same millisecond still have 80 bits of randomness, so collision risk remains negligible.
Should I choose UUID v4 or ULID?
Choose ULID when you need sortability, shorter URL representation and better readability. Choose UUID v4 for maximum compatibility and when you do not want to leak generation time. For new systems needing time-sortable primary keys, consider UUID v7 directly.
Which alphabet should a token use?
Hex is simplest and most readable; Base64 is shortest but includes +/= which can break URLs; Base62 strips special characters, balancing length and URL safety; Base58 also removes visually confusing characters (0/O, I/l), ideal for manual entry.
Should an API Key be a UUID or a random token?
API keys should use a cryptographically secure random token (at least 128 bits), not a raw UUID. UUIDs are designed for uniqueness; while they provide enough entropy, dedicated tokens give you control over length, alphabet and prefixes (e.g. sk_live_xxx), making permission scoping easier.