How do Python's uuid.uuid4, uuid.uuid1 and uuid.uuid5 differ in where their bits come from?

A UUID is 128 bits — sixteen bytes. Six of them are spoken for: four bits hold the **version** nibble and two or three hold the **variant** that says which specification the layout follows. The version is the interesting part for an interview, because it names the strategy that produced the remaining bits, and Python's `uuid` module exposes one function per strategy. ### uuid.uuid4 — random bits `uuid.uuid4()` reads sixteen bytes from the operating system's random source, overwrites the version and variant fields, and hands back the result. That leaves 122 free bits. There is no shared state, no clock, no coordination between machines, and nothing in the value that can be traced back to where it was made. Two processes on two continents can each mint millions of them and the chance of a collision stays negligible. The price of that is that the value is *only* an identifier: you cannot recompute it, you cannot derive it from your data, and it tells you nothing about ordering. ### uuid.uuid1 — clock plus node `uuid.uuid1()` composes three things: a 60-bit timestamp counting 100-nanosecond intervals since 1582-10-15, a 14-bit clock sequence that is re-randomised when the clock appears to go backwards, and a 48-bit node identifier obtained from `uuid.getnode()`. `getnode()` returns the machine's hardware address when it can read one, and otherwise a random 48-bit value with the multicast bit set, stable for the life of the process. Uniqueness here comes from coordination — distinct hosts, a clock that mostly moves forward — rather than from entropy. The inputs are readable back out of the value through `UUID.time`, `UUID.node`, `UUID.clock_seq` and `UUID.fields`, which is simultaneously the feature and the drawback: a version 1 UUID handed to an outside party tells them when it was created and, if the node came from real hardware, gives them a stable per-machine fingerprint. ### uuid.uuid5 — namespace and name `uuid.uuid5(namespace, name)` is the deterministic one. It concatenates the namespace UUID's sixteen bytes with the name (a `str` is encoded as UTF-8; `bytes` is accepted directly on 3.14), takes a SHA-1 digest, keeps the leading sixteen bytes and stamps version 5 and the variant. The same namespace and name give the same UUID on any machine, in any process, forever. `uuid.uuid3` is the identical construction over an MD5 digest with version 3; prefer `uuid5` in new code. The module ships four namespace constants — `uuid.NAMESPACE_DNS`, `uuid.NAMESPACE_URL`, `uuid.NAMESPACE_OID` and `uuid.NAMESPACE_X500` — and nothing stops you from pinning a constant of your own instead; the namespace simply partitions names so that the same string under two namespaces yields two different ids. Determinism is what you are buying: an identifier you can recompute from business data instead of storing a lookup table. It is also the limitation. The value is *derived*, not secret — anyone who can guess the inputs can reproduce it — so it is not a substitute for a token that has to be unguessable. ### Choosing between them An opaque surrogate identifier with no story attached: `uuid4`. An identifier you want to regenerate from stable inputs so a repeated operation lands on the same row: `uuid5`. An identifier whose creation time you genuinely want embedded: `uuid1` will do it, though Python 3.14 also added `uuid.uuid6`, `uuid.uuid7` and `uuid.uuid8` from the newer specification, plus the `uuid.NIL` and `uuid.MAX` constants. ### Traps worth naming out loud "Guaranteed unique" is wrong for all of them. `uuid4` is *collision-improbable*; `uuid1` is unique only while its assumptions about distinct nodes and a sane clock hold. `UUID.version` reads the stamped nibble rather than inferring anything, so a `UUID` you build yourself from arbitrary bits with `uuid.UUID(int=...)` can report a version nobody generated. And the generator functions return `UUID` objects, not strings — the 36-character hyphenated form only appears when something calls `str()` on one. ```python import uuid print(uuid.uuid4().version, uuid.uuid1().version) print(uuid.uuid5(uuid.NAMESPACE_DNS, "example.com")) print(uuid.uuid5(uuid.NAMESPACE_DNS, "example.com")) ``` The two `uuid5` lines print the same value every time you run the file; two `uuid4` calls never will.