UUID / GUID Generator (v4 & v7)

What is a UUID (and how is it different from a GUID)?

A UUID (Universally Unique Identifier) is a 128-bit value, standardized in RFC 9562, used to identify something without a central coordinating authority. GUID is Microsoft's name for the same format: a System.Guid in .NET can hold any UUID version.

UUID v4 vs. v7: which should I use?

v4 is fully random (122 random bits), so nothing about it reveals when it was created. v7 embeds a 48-bit millisecond Unix timestamp followed by random bits, so v7 values generated close together in time sort close together, which is much better for B-tree database indexes (sequential inserts instead of scattered random writes) when used as a primary key.

How do I generate a UUID v7 in .NET?

.NET 9 added Guid.CreateVersion7() directly on the existing System.Guid type:

// .NET 9+
Guid idV7 = Guid.CreateVersion7();      // time-ordered, good for DB keys
Guid idV4 = Guid.NewGuid();             // random (v4)

string jti = idV7.ToString();           // use as a JWT "jti" claim, etc.

What's the chance two UUIDs collide?

Vanishingly small. v4 has 122 random bits, so the "birthday problem" math says you'd need to generate on the order of 2.71 × 10^18 UUIDs before a 50% chance of any collision. In practice, don't worry about UUID collisions for identifiers, session IDs, or database keys.

Where are UUIDs commonly used in OAuth/OIDC?

As a jti (JWT ID) claim to detect token replay, as client_id values, session identifiers, and request correlation IDs. Any version works for a jti, since only uniqueness matters there; for a client_id that appears in a public redirect URL, v4 avoids exposing a creation timestamp, while v7 is fine if that's not a concern. See the JWT decoder to inspect how jti and other claims appear inside a real token, and IdentityServer docs.