TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report on UUIDv7 says the format does not guarantee that its embedded timestamp matches an object’s creation time or that IDs are strictly time-ordered. RFC 9562 permits timestamp adjustments, and the report describes how Python’s UUIDv7 generator can move its timestamp ahead of a clock that has jumped backward.
A technical report on UUIDv7 says developers should not assume its embedded timestamp precisely records when an object was created or that UUIDs are strictly ordered by time. The report points to RFC 9562, which allows timestamp adjustments, and describes a Python implementation in which a backward system-clock jump can cause the UUID timestamp to run ahead of clock time.
UUIDv7 combines a timestamp with other bits used to generate an identifier. That design can make IDs roughly sortable and can expose a creation-time estimate. But the report, published by Built on Shards of Silicon, argues those commonly advertised properties are not guaranteed in every compliant implementation. It says uniqueness is the property the format can more reliably provide, while the usefulness of the timestamp and the strength of ordering depend on implementation behavior and operating conditions.
The report cites PostgreSQL documentation for uuid_extract_timestamp, which cautions that the extracted timestamp is not necessarily exactly the time a UUID was generated. It also points to RFC 9562 sections allowing implementations to alter timestamps and, in some circumstances, increment them ahead of the system clock. The specification does not set a required level of accuracy between the encoded clock value and actual time, according to the report’s excerpts.
As an example, the author describes Python’s standard-library uuid.uuid7() behavior. In a test, after the system clock was moved back an hour, repeated UUID generation caused the embedded timestamp to move ahead of the clock. The report’s sample output showed a gap growing from about 3,695 seconds to 3,995 seconds during the run. The author says the effect depends on conditions such as generation rate and counter behavior; it is not a claim that every UUIDv7 generator will behave this way.
When UUID Time Misleads
The findings matter for systems that use UUIDv7 as a substitute for a separate creation-time field or rely on identifiers to provide a strict chronological sequence. If an application needs an accurate event time for audit records, billing, retention, or user-facing dates, an ID alone may not be a suitable source of truth. Teams may need to store the relevant time explicitly and decide how to handle clock corrections.
Ordering also has limits. UUIDv7 can provide a rough ordering signal, but the report warns that different clocks and generation behavior can leave IDs out of exact time order. Distributed systems cannot generally infer a perfectly reliable global event sequence from clocks alone. The report’s focus is not that UUIDv7 is unusable, but that its properties should be matched to the application’s actual requirements.
The embedded timestamp also travels wherever the identifier is shared. The author gives the example of an account URL whose ID could reveal when an account was created, even if the page does not show that date. The report characterizes this as a context-dependent privacy concern, rather than a severe security flaw in most cases.
As an affiliate, we earn on qualifying purchases.
What RFC 9562 Allows
UUIDv7 is specified in RFC 9562, which permits implementations to use timestamp-related techniques intended to preserve ordering when multiple identifiers are generated close together. The source report describes a tension between keeping IDs increasing and keeping the timestamp close to wall-clock time. When the clock moves backward or a generator’s counter reaches its limit, an implementation may prioritize monotonic behavior by adjusting the timestamp.
The RFC recommends a counter of at least 12 bits, according to the report. At more than 4,096 generated IDs per millisecond per node, such a counter could overflow under the described setup. The author notes that counter overflow is not the only relevant condition: a clock that freezes or moves backward can also affect how a generator advances. These details are implementation-specific, so the behavior of one library should not be treated as a description of every UUIDv7 generator.
The report also cautions against treating identifiers generated on separate machines as a perfectly synchronized global sequence. Small clock differences can complicate timestamp-based ordering, even where each machine produces IDs that increase locally. The article frames UUIDv7’s ordering as approximate, not as a replacement for coordination mechanisms designed to represent event order.
“Implementations MAY alter the actual timestamp.”
— RFC 9562, as quoted in the report
distributed systems clock synchronization NTP PTP
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How Often Clocks Cause Drift
The report does not establish how often UUIDv7 timestamps drift in production, or how many users and systems encounter the specific behavior shown in the Python example. Its test demonstrates a possible outcome under a deliberate backward clock adjustment and sustained UUID generation; it is not a field study or evidence that all generators exhibit runaway drift.
The supplied material also does not quantify the impact of timestamp exposure on privacy, nor does it compare the behavior of every UUIDv7 library and configuration. The author says similar behavior appears in other implementations, but the excerpt does not identify all of them or provide a systematic cross-implementation test. How much timestamp accuracy or ordering matters will depend on an application’s needs.
database audit logging timestamp best practices
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Check Generator and Data Needs
For developers, the immediate practical step is to check the UUID library’s documented behavior and test how it handles backward clock changes, counter limits, and high generation rates. Applications that require reliable event times should keep those times in a separate field, while systems that need a strict distributed ordering should use a mechanism designed for that requirement rather than relying on UUIDv7 alone.
The report says the Python behavior has been discussed by developers, who reasoned that it is consistent with the RFC and other implementations and that there may be limited options on a system with a flawed clock. The author agrees those points may be correct but argues implementations could handle clock jumps without allowing the timestamp to run away. The supplied material does not identify a planned fix or a release timeline, so whether library behavior will change remains open.
Python UUIDv7 programming reference
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does a UUIDv7 timestamp show exactly when an object was created?
No, not reliably. RFC 9562 permits timestamp adjustments, and PostgreSQL’s documentation warns that an extracted timestamp may not exactly match the time the UUID was generated. Applications needing an accurate creation time should store it separately.
Are UUIDv7 identifiers strictly ordered by time?
No strict global ordering is guaranteed. UUIDv7 can offer rough ordering, but clocks may differ and implementations may adjust timestamps. The report advises against treating UUIDv7 as a guaranteed sequence of events across machines.
What happened in the Python example?
The report describes moving the system clock back an hour while generating UUIDv7 values with Python’s standard-library function. In the test, the encoded timestamp moved ahead of clock time, with the gap growing during sustained generation. This demonstrates a possible behavior under those conditions, not a result for every UUIDv7 implementation.
Can UUIDv7 reveal private information?
It can expose a timestamp estimate wherever the identifier is shared. The report gives an account URL as an example, while describing the privacy risk as dependent on the situation rather than generally severe.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
