UUIDv7 doesn't have the properties you think it does

The article "UUIDv7 doesn't have the properties you think it does" debunks common misconceptions about the UUIDv7 version of universally unique identifiers (UUIDs). While many blog posts praise UUIDv7 for its benefits, the author found that none of these properties are strictly held.

One key property UUIDv7 claims to provide is uniqueness, which ensures collision resistance. However, the timestamp embedded in UUIDv7 IDs may not accurately reflect the object's creation time. The Postgres documentation warns that the extracted timestamp is not necessarily exactly equal to the generation time. RFC 9562, which governs UUIDv7, allows implementations to alter the timestamp field, using values not strictly derived from the system clock. This can result in a large discrepancy between the timestamp and the actual time.

Furthermore, implementations may increase the timestamp ahead of the actual time, which can lead to unexpected behavior. For instance, UUIDv7's Python standard library implementation increments the timestamp only in certain circumstances, such as when the counter overflows. This can cause the timestamp to race ahead of the system time, potentially by an arbitrarily large amount. The generator can get stuck in an increment cycle if the clock ever jumps backwards, or when the load exceeds one ID per millisecond.

Embedding the timestamp in the ID means that it cannot be shared without also sharing the timestamp, limiting its usefulness in certain contexts. For example, a user profile page that doesn't disclose the creation time but uses a UUIDv7 ID in the URL inadvertently leaks the high-precision timestamp. While this issue is relatively low on the list of security concerns, it could be relevant in time-sensitive environments where clocks may jump backwards or become significantly desynchronized.

Despite these challenges, UUIDv7 IDs can still provide a rough ordering, which may be suitable for some requirements. However, it's crucial to understand that strictly monotonic UUIDv7 IDs are not guaranteed by the specification. Implementations may perform better than others, but the fundamental problem of synchronizing system clocks across nodes has been known since the 1970s and cannot be strictly solved.