Can Two UUIDs Be the Same? UUID Uniqueness & Collision Explained

If you are architecting a distributed database, designing a multi-tenant API, or generating primary keys across millions of microservices, you have probably asked: Can two UUIDs be the same?

Here is the direct, technical answer:

In theory: Yes, two UUIDs can be identical. Because a UUID is a finite 128-bit number, no mathematical guarantee exists that prevents two independent generators from ever producing the same bit sequence.
In practice: An accidental collision is astronomically, vanishingly unlikely. When using a standard, cryptographically secure generator (such as UUID v4), there are $2^{122} \approx 5.3 \times 10^{36}$ possible combinations. You would need to generate billions of UUIDs every second for centuries before facing a realistic collision risk.
The Engineering Rule: Even though collision probability is negligible, you should always define PRIMARY KEY or UNIQUE constraints in your database as a fundamental defense-in-depth practice.

┌────────────────────────────────────────────────────────────────────────┐
│                        WHAT IS A UUID COLLISION?                       │
├────────────────────────────────────────────────────────────────────────┤
│ Generator 1 (Server in US):  550e8400-e29b-41d4-a716-446655440000     │
│ Generator 2 (Server in EU):  550e8400-e29b-41d4-a716-446655440000     │
│                                                                        │
│ Result: Two independently generated UUIDs match exactly.               │
│ Real-World Risk: ~0.00000000000000000000000000000000000001%           │
└────────────────────────────────────────────────────────────────────────┘

In this comprehensive guide, we will unpack what a UUID collision is, the mathematics of collision probability and the birthday paradox, how different UUID versions handle collisions, and what happens if duplicate IDs appear in a database.

1. What Does “Unique” Actually Mean for a UUID?

The term UUID stands for Universally Unique Identifier (standardized in RFC 9562).

However, in computer science and mathematics, “unique” does not mean “impossible to duplicate.”

┌────────────────────────────────────────────────────────────────────────┐
│                   THE TWO TYPES OF UNIQUENESS                          │
├───────────────────────────────────┬────────────────────────────────────┤
│ 1. MATHEMATICAL UNIQUENESS        │ 2. PRACTICAL UNIQUENESS (UUIDs)    │
│ • Impossible to ever repeat       │ • Search space is so massive that  │
│ • Requires a central counter      │   independent systems can generate │
│ • Fails in distributed systems    │   IDs without coordination.        │
└───────────────────────────────────┴────────────────────────────────────┘

Because a UUID is stored in 128 binary bits, the total number of possible combinations is finite:

$$2^{128} = 340,282,366,920,938,463,463,374,607,431,768,211,456 \approx 3.4 \times 10^{38} \text{ values}$$

Because the pool of numbers is finite, selecting numbers at random can theoretically produce a duplicate. However, the size of this number pool is so immense that humanity could never exhaust it.

If you need a fresh, cryptographically unpredictable identifier right now, use our free UUID Generator.

2. What Is a UUID Collision?

A UUID collision occurs when two independent generation events produce the exact same 128-bit identifier for two separate entities:

UUID A: 550e8400-e29b-41d4-a716-446655440000
UUID B: 550e8400-e29b-41d4-a716-446655440000

What a Collision Is NOT:

Copying or Reusing an ID: If an application reads an existing user ID and assigns it to another record, that is a software bug, not a collision.
Deterministic Hashing: In UUID v3 and UUID v5, hashing the exact same namespace and string will always output the exact same UUID by design.
Database Updates: Overwriting an existing row via UPDATE users SET ... WHERE id = ... is standard database operation.

A true collision is strictly an accidental generation match between two unrelated entities.

3. Why Are UUID Collisions So Unlikely?

To understand why collisions are virtually impossible in real-world systems, let’s examine the structure of UUID Version 4 (Random):

  550e8400  -   e29b   -   41d4   -   a716   -   446655440000
 [ 32 bits ]  [16 bits]  [16 bits]  [16 bits]  [  48 bits    ]
                          ▲          ▲
                     Version=4    Variant=10

Under RFC 9562:

4 bits are fixed for the Version (0100 = 4).
2 bits are fixed for the Variant (10).
122 bits are generated from cryptographically secure random entropy.

$$\text{UUID v4 Random Combinations} = 2^{122} \approx 5.316 \times 10^{36}$$

To put $5.3 \times 10^{36}$ in perspective:

There are an estimated $7.5 \times 10^{18}$ grains of sand on all of Earth’s beaches combined.
The number of UUID v4 possibilities is over 700 billion times greater than the number of grains of sand on the entire planet squared.

4. UUID Collision Probability and the Birthday Paradox

When evaluating collision risk, developers often make the mistake of asking: “What are the odds that a newly generated UUID matches this specific existing UUID?” (Which is $\frac{1}{2^{122}} \approx 1.88 \times 10^{-37}$).

The correct statistical question is governed by the Birthday Paradox: “In a database with $n$ total UUIDs, what is the probability that any two UUIDs match each other?”

The Birthday Paradox:
In a room of just 23 people, there is a 50% chance that ANY two people share 
the same birthday, even though each individual has a 1/365 chance of matching a specific date.

The Collision Probability Formula:

For a total random space $N = 2^{122}$ and $n$ generated UUIDs, the approximate collision probability is given by:

$$P(\text{collision}) \approx 1 - e^{-\frac{n^2}{2N}} \approx \frac{n^2}{2 \times 2^{122}} = \frac{n^2}{2^{123}}$$

Real-World Collision Probabilities for UUID v4:

Total UUIDs Generated ($n$)	Approximate Collision Probability	Real-World Equivalent
1 Million ($10^6$)	$\approx 9.4 \times 10^{-26}$	Far less likely than winning the lottery 3 times in a row
1 Billion ($10^9$)	$\approx 9.4 \times 10^{-20}$	Less likely than being hit by a meteorite
1 Trillion ($10^{12}$)	$\approx 9.4 \times 10^{-14}$	1 in 10 trillion chance
100 Trillion ($10^{14}$)	$\approx 9.4 \times 10^{-10}$	1 in 1 billion chance

5. How Many UUIDs Before a 50% Collision Risk? (The Birthday Bound)

To reach a 50% probability of encountering a single accidental collision in UUID v4, the required number of generated identifiers is approximately the square root of the total state space:

$$n \approx \sqrt{2^{122}} = 2^{61} \approx 2,305,843,009,213,693,952 \text{ UUIDs} \approx 2.3 \times 10^{18}$$

┌────────────────────────────────────────────────────────────────────────┐
│                     THE 50% COLLISION THRESHOLD                        │
├────────────────────────────────────────────────────────────────────────┤
│ If your application generates 1 billion UUIDs every single second:     │
│                                                                        │
│    2.3 × 10^18 ÷ 1,000,000,000 UUIDs/sec ≈ 2.3 × 10^9 seconds          │
│                                          ≈ 73 YEARS of continuous work │
└────────────────────────────────────────────────────────────────────────┘

Even after generating 1 billion IDs every second for 73 years, the chance of a duplicate is still only 50%.

6. Can UUID Version 7 (UUID v7) Collide?

UUID Version 7 (standardized in RFC 9562) is the modern time-ordered UUID format designed for database B-Tree index efficiency:

[ 48-bit Unix Timestamp (ms) ] - [ 12-bit Version/Random ] - [ 62-bit Variant/Random ]

018d3b7d-3b7d-7bad-9bdd-2b0d7b3dcb6d

UUID v7 Collision Mechanics:

Across Different Milliseconds: Two UUID v7s generated in different milliseconds can never collide because their leading 48-bit timestamp fields are mathematically different.
Within the Same Millisecond: Within a single millisecond, UUID v7 provides 74 bits of random entropy (or optional sub-millisecond sequence counters).
Collision Risk: With 74 bits of entropy per millisecond, a system would need to generate over 600,000 UUIDs within the exact same millisecond on a single node before the collision risk reaches one in a billion.

Learn more about time-ordered database indexing in our UUID v7 Generator.

7. Collision Risk Across All UUID Versions

UUID Version	Primary Generation Input	Collision Risk Characteristics
UUID v4	Cryptographic Random Numbers	Extremely Low: Governed by 122 bits of random entropy.
UUID v7	Unix Millisecond Timestamp + Randomness	Extremely Low: Timestamp guarantees separation across time.
UUID v1	100ns Timestamp + Hardware MAC Address	Low: Can collide if system clock rolls back or multiple VMs share a MAC.
UUID v3	MD5 Hash (Namespace + Name)	Deterministic: Identical inputs intentionally produce identical UUIDs.
UUID v5	SHA-1 Hash (Namespace + Name)	Deterministic: Identical inputs intentionally produce identical UUIDs.

You can validate and inspect the version bits of any identifier using our free UUID / GUID Validator.

8. Can UUIDs Be Intentionally the Same?

Yes. In certain software architectures, generating identical UUIDs is a deliberate feature rather than an accidental bug:

1. Deterministic Name-Based UUIDs (v3 and v5)

When you want two microservices to generate the exact same identifier for a known entity (e.g., a URL or DNS domain) without sharing a database:

// UUID v5 with DNS namespace for "example.com" will ALWAYS produce:
// "cfbff0d1-9375-5685-968c-48ce8b15ae17"

2. Idempotent API Requests

Clients often send a client-generated UUID as an Idempotency-Key header. If a network timeout occurs, retrying the request with the same UUID allows the server to recognize the duplicate and avoid charging a credit card twice.

9. Are UUIDs Guaranteed to Be Unique?

No.

As a professional software engineer, you should never state that UUIDs provide a “100% mathematical guarantee” of uniqueness.

Finite random spaces cannot offer absolute guarantees.
Hardware failures, flawed random number generators, and virtual machine snapshot rollbacks can introduce duplicate random states.

Instead, state that UUIDs provide practical uniqueness sufficient for all modern software engineering requirements.

10. UUIDs and Database Integrity: Why You Still Need Unique Constraints

Because a UUID generator cannot mathematically guarantee zero collisions, your database schema must always enforce uniqueness at the storage layer:

-- ✅ CORRECT: Database enforces primary key integrity
CREATE TABLE users (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    email VARCHAR(255) NOT NULL UNIQUE
);

What Happens If a Duplicate UUID Is Inserted?

With a PRIMARY KEY or UNIQUE Constraint: The database engine will immediately reject the transaction and throw an error (duplicate key value violates unique constraint). The existing record remains completely safe and uncorrupted.
Without a Constraint: The database will silently insert a second row with the identical ID, leading to critical application corruption when queries like SELECT * FROM users WHERE id = ... return multiple conflicting rows.

11. What Causes Real-World UUID Duplicates?

When duplicate UUIDs occur in production environments, they are almost never caused by random statistical collisions. Instead, they result from one of these three implementation flaws:

Weak Random Number Generators: Using non-cryptographic pseudo-random functions like Math.random() in JavaScript or rand() in C.
Virtual Machine Snapshot Cloning: When a cloud server VM is snapshotted in RAM and cloned across 50 worker nodes, all 50 nodes may start with the exact same internal PRNG seed state.
Improper Multi-Threading: Multiple CPU threads accessing an un-synchronized custom UUID generator simultaneously.

12. UUID vs. Sequential Auto-Increment IDs

┌──────────────────────────────────────┬──────────────────────────────────────┐
│ SEQUENTIAL AUTO-INCREMENT IDs        │ UUIDs (UNIVERSALLY UNIQUE IDs)       │
├──────────────────────────────────────┼──────────────────────────────────────┤
│ • Guarantees 0% collision rate       │ • Theoretical collision risk (~0%)   │
│ • Requires a single central database │ • Decentralized & distributed        │
│ • Leaks total record counts in URLs  │ • Opaque & unguessable in URLs       │
│ • Fails in offline-first mobile apps │ • Works offline & merges seamlessly  │
└──────────────────────────────────────┴──────────────────────────────────────┘

For distributed systems and offline applications, the minute theoretical collision risk of a UUID is vastly outweighed by the ability to generate IDs anywhere without database network roundtrips.

13. Best Practices to Prevent Duplicate UUID Issues

Always Use OS-Level CSPRNGs: Generate UUIDs using native cryptographic APIs (crypto.randomUUID(), uuid.uuid4(), Guid.NewGuid()).
Always Define Database Constraints: Always declare PRIMARY KEY or UNIQUE on UUID columns.
Use UUID v7 for Time-Ordered Records: Minimize potential collision windows by incorporating millisecond timestamps.
Never Build Custom Random Logic: Never use Math.random() to generate unique identifiers.
Handle Database Insertion Retries: In the astronomically rare event of a duplicate key error, catch the exception and retry with a new UUID.

If you need to batch-generate thousands of collision-tested test identifiers, explore our Bulk UUID Generator.

14. Frequently Asked Questions (FAQ)

Can two UUIDs be the same?

Yes, in theory two UUIDs can match because a UUID represents a finite 128-bit space. However, for properly generated random UUIDs (UUID v4), the probability of an accidental collision is virtually zero.

Are UUIDs guaranteed to be unique?

No. UUIDs are designed for practical uniqueness, not absolute mathematical impossibility of duplication.

How likely is a UUID v4 collision?

With 122 bits of cryptographic random entropy, generating 1 billion UUIDs gives a collision probability of approximately 1 in 10 quintillion ($9.4 \times 10^{-20}$).

Can two computers generate the same UUID v4?

Theoretically yes, but practically no. Two independent computers generating billions of IDs will never accidentally generate matching 122-bit random values.

Can UUID v7 collide?

UUID v7 includes a 48-bit millisecond timestamp, making collisions across different milliseconds impossible. Within the same millisecond, it provides 74 bits of random entropy.

What happens if two identical UUIDs are inserted into a database?

If the column has a PRIMARY KEY or UNIQUE constraint, the database rejects the second insert and raises a constraint violation error.

Can UUIDs be intentionally identical?

Yes. Name-based UUIDs (v3 and v5) deterministically produce the exact same UUID when given identical namespace and name strings.

Is UUID collision the same as a duplicate UUID?

A collision refers to two independent random generation processes producing the same value. A duplicate UUID can also occur due to application bugs, data replication errors, or copy-pasting.

15. Conclusion & Developer Tools

In summary: Two UUIDs can theoretically be the same, but with cryptographically secure generators, accidental collisions will never happen in normal software lifecycles.

By enforcing database constraints and relying on standard RFC 9562 libraries, you can build massively scalable, distributed systems with complete confidence.

Explore our full suite of free developer tools:

UUID Generator — Create instant, cryptographically secure UUID v4 and v7 identifiers.
UUID v4 Generator — Generate pure 122-bit random UUIDs.
UUID v7 Generator — Generate modern time-ordered database UUIDs.
UUID / GUID Validator — Validate syntax, inspect version & extract timestamps.
Bulk UUID Generator — Generate up to 10,000 identifiers in batch.
Base64 UUID Generator — Convert 128-bit UUIDs into compact 22-character strings.