Why You Should Never Use UUID v1 in Public APIs (Privacy Leaks Explained)
Discover how UUID version 1 leaks your server's hardware MAC address and exact creation timestamps, creating severe security and privacy vulnerabilities.
UUID v1 exposes the server's physical network interface MAC address in its final 48 bits (node ID) and an exact timestamp in the first 60 bits. Publishing UUID v1 strings in public APIs or URLs allows attackers to identify backend server clusters, track host migrations, and enumerate business metrics.
Solve this problem now with our free UUID / GUID Generator
Try it instantly in your browser — zero tracking, 100% client-side privacy.
Specification & Architecture Reference
| UUID Component | Extracted Information | Security & Privacy Threat |
|---|---|---|
| Bytes 10-15 (Node Field) | Server hardware MAC address (e.g., 00:1A:2B:3C:4D:5E) | Uniquely identifies specific virtual machines or physical server hardware |
| Bytes 0-7 (Timestamp) | Exact nanosecond timestamp (since 1582) | Enables competitors to measure transaction velocity and user signup counts |
| Clock Sequence | Process ID / sequence counter | Reveals server reboots and process restarts |
The Design of Version 1 UUIDs
Specified in RFC 4122, **UUID v1** was designed to guarantee uniqueness across distributed systems without requiring centralized coordination. It achieves this by combining: 1. **Timestamp:** 60-bit count of 100-nanosecond intervals since October 15, 1582 (the Gregorian calendar reform). 2. **Clock Sequence:** 14-bit counter to prevent duplicates if the clock rolls back. 3. **Node Identifier:** 48-bit **MAC (Media Access Control) address** of the host machine's network card.
An example UUID v1: ```text 6ba7b810-9dad-11d1-80b4-00c04fd430c8 ``` The final chunk `00c04fd430c8` corresponds to MAC address `00:C0:4F:D4:30:C8`, registered to 3Com Corporation.
Why This is a Significant Security Liability - **Deanonymization:** If an anonymous whistleblowing platform or medical app assigns UUID v1 identifiers to user records, anyone inspecting the ID can pinpoint the physical machine that generated it. - **Server Farm Topology Leakage:** Attackers inspecting public user IDs can identify how many distinct machines exist in your auto-scaling cluster and track when traffic migrates between instances. - **Predictability & Enumeration:** Because timestamps advance predictably, an attacker who obtains one UUID can approximate past and future IDs, facilitating ID-enumeration attacks.
The Modern Alternative Never expose UUID v1 in public URLs, API endpoints, or database IDs. Use **UUID v4** (pure random) or **UUID v7** (randomized node bits with a millisecond timestamp).
Generate secure, privacy-safe identifiers with Mickytool's **UUID / GUID Generator**.
Solve this problem now with our free UUID / GUID Generator
Execute this workflow immediately without saving data on remote servers.
Frequently Asked Questions
Can an attacker spoof UUID v1 IDs?
If an attacker knows the MAC address and approximate server time, they can generate candidate UUIDs within a narrow brute-force range, undermining ID unpredictability.
Was the Melissa virus creator caught using UUID v1?
Yes. In 1999, the author of the Melissa worm was identified partly because the GUID inside the infected Word document contained his personal computer's MAC address.