Ask HN: We just had an actual UUID v4 collision...

Article summary

A developer reported a collision of two UUID v4 identifiers in their database, which is statistically extremely unlikely. The collision occurred between a record from 2025 and a new record inserted in 2026. The developer is using the uuid package from npm and is wondering how this could have happened. The database has only 15,000 records, making the collision even more surprising.

Main themes

• UUID collision
• Statistical probability
• Random number generation
• Database uniqueness
• UUID variants

What commenters say

• The collision is likely due to a weakness in the random number generator used to create the UUIDs, rather than a statistical fluke.
• Using a different UUID variant, such as v1 or v7, which includes timestamp data, could help prevent collisions.
• Appending a date or timestamp to the UUID could also help prevent collisions, but may not be necessary or desirable.
• The use of user-generated UUIDs may be a security risk, as it allows untrusted sources to enter the system.
• The likelihood of a collision is not affected by previous events, and the probability of winning the lottery remains the same despite the unlikely event of a UUID collision.
• UUID v7, which includes a timestamp, may not be more collision-proof than v4 due to the reduced number of entropy bits.
• A collision in UUID v7 is more likely to occur when the system clock is not set to the current time, such as during a system boot sequence.