Inspecting UUIDs and ULIDs: Version, Variant, and Embedded Timestamps

A UUID or ULID in a log line looks opaque until you need to know when it was created, which version it is, or whether a client invented a malformed ID. Guessing from string length alone is how teams mis-attribute bugs to "the database" when the real issue is a v4 key treated like a sortable v7, or a ULID pasted into a UUID column. Inspection turns identifiers into structured facts.

Bottom line: Decode before you assume. Use an ID inspector to read UUID version/variant and ULID timestamps in the browser. Generate test IDs with UUID and ID generator tools — keep production tokens and customer IDs on your machine, not in upload-based decoders.

Who this guide is for

Backend and frontend developers who debug primary keys, correlation IDs, webhook payloads, and support tickets that only include an opaque ID. If you choose ID formats in greenfield systems, pair this with a comparison of UUID vs ULID vs Nano ID; this article focuses on reading what you already have.

What an inspector reveals

Format	What you can extract
UUID	Version (1–8), variant, optional timestamp/node (v1/v6/v7), randomness layout
ULID	48-bit millisecond timestamp, 80-bit randomness, lexicographic time order
Invalid	Wrong length, bad alphabet, misplaced hyphens, non-hex characters

Paste a candidate string into the UUID & ULID Inspector to see structured fields instead of eyeballing hex.

UUID anatomy in one screen

Canonical text form:

xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx
              ^    ^
           version variant

• Version lives in the high nibble of the 13th hex digit (M).
• Variant lives in the high bits of the 17th hex digit (N). RFC 4122 / RFC 9562 variant 10xx is the common "RFC" variant.

Versions you will actually see

Version	Meaning	Inspector focus
v1	Time + node	Timestamp and (historically) MAC-derived node
v4	Random	Almost no structure; confirm version nibble is 4
v5	Name-based SHA-1	Deterministic from namespace + name
v6	Reordered time	Time-sortable layout, modern alternative to v1
v7	Unix ms + random	Embedded Unix timestamp; great for DB keys
v8	Custom	Layout is application-defined — inspector shows version only

If support asks "when was this created?" and you have a v4 UUID, the honest answer is: you cannot know from the ID alone. If you have v7 or a ULID, you can.

Variant mistakes

Some libraries emit non-RFC variants or strip hyphens inconsistently. An inspector that reports variant helps explain interoperability failures between systems that validate strictly and ones that accept any 128-bit hex blob.

ULID anatomy in one screen

A ULID is 26 Crockford Base32 characters:

01ARZ3NDEKTSV4RRFFQ69G5FAV
└── timestamp ─┘└─ randomness ─┘

• First 10 characters: milliseconds since Unix epoch
• Last 16 characters: randomness
• Sorting the string sorts by time

When logs show ULIDs, extract the timestamp to correlate with deploy windows, cron jobs, or outage timelines. The inspector converts that prefix to a human-readable instant so you do not hand-decode Base32 under pressure.

Debugging workflows

1. "Is this even a UUID?"

Symptoms: ORM rejects the value, Postgres uuid cast fails, or a client sends undefined stringified.

Checklist:

1. Length 36 with hyphens, or 32 without?
2. Only hex characters?
3. Version nibble plausible?
4. Or is it a ULID / Nano ID / Stripe-style id_ prefix?

Run the string through the ID inspector first. If it fails, stop treating it as a UUID in SQL.

2. Index and ordering surprises

Team expects inserts to be time-ordered; indexes fragment; ORDER BY id does not match created_at.

Inspect a sample of recent IDs:

• All v4 → ordering will not match creation time
• v7 or ULID → string/byte order should track creation (within clock skew)

Fix the generator, not the index — or add a real created_at and stop overloading the ID.

3. Clock skew and "future" ULIDs

ULID and UUID v7 embed wall-clock time. A machine with a wrong clock emits IDs that sort into the future or past. If inspector timestamps disagree with server created_at by minutes, check NTP before blaming the database.

4. Support tickets with only an ID

When a user pastes an ID into chat:

1. Identify format (UUID vs ULID vs other)
2. Extract timestamp if present
3. Search logs near that instant
4. Confirm environment (staging IDs sometimes leak into prod tickets)

Generating IDs for tests

Inspection is only half the loop. For fixtures:

• UUID Generator — emit v4 (and other versions your tool supports) for API mocks
• ID Generator — mix ULID / Nano ID / custom patterns for URL-facing IDs

Prefer stable fixtures in unit tests (hard-coded IDs) and random generation in integration tests where collision policy matters. Document which version your production app emits so test data matches reality.

Security and privacy notes

IDs are often considered public (they appear in URLs). Still:

• UUID v1 historically leaked MAC addresses — treat old v1 IDs as potentially identifying hardware
• Timestamps in ULID/v7 reveal creation time — usually fine, sometimes sensitive for enumeration narratives
• Never paste private keys or session tokens into an "ID" field by mistake

codefunc inspectors and generators run client-side: paste, inspect, copy — with no upload of the string to codefunc servers. That matters when IDs appear next to customer payloads in the same clipboard buffer.

Common mistakes

Mistake	Why it hurts	Fix
Storing ULID in a UUID column	Type and validation errors	Use text/char(26) or convert deliberately
Assuming all UUIDs have timestamps	v4 has none	Inspect version first
Case-folding ULIDs incorrectly	Crockford allows some aliases	Normalize with a proper library
Comparing ID time to local TZ without conversion	Wrong incident window	Use UTC in logs and inspector output
Validating only with regex	Accepts wrong versions	Parse version/variant bits

Related tools

Use these codefunc tools alongside this guide:

• UUID & ULID Inspector
• UUID Generator
• ID Generator

Practical takeaway

Do not guess ID semantics from length alone. Inspect UUID version and variant, and decode ULID or UUID v7 timestamps when you need time correlation. Align generators with database ordering expectations, watch clock skew, and keep support workflows on structured decode rather than tribal knowledge. Use the ID inspector plus UUID and ID generator tools in the browser so identifiers never need to leave your machine for routine debugging.

Sources

• RFC 9562 — Universally Unique IDentifiers (UUIDs)
• ULID specification
• Crockford Base32
• PostgreSQL: UUID type