Security

UUID Generator

Generate v4 and v7 UUIDs instantly with bulk, format, and validate.

Generator settings

Formatting

Formatting like uppercase, hyphens, prefix and suffix reformat the current results instantly — no new values are generated.

Press Generate to create UUIDs — they appear here.

No results yet

Download:

UUID validator

Validity follows RFC 4122: the version nibble (first character of the third group) and the variant bits (first character of the fourth group) must match a defined scheme.

Ctrl + Enter Generate · Ctrl + Shift + C Copy all · Ctrl + Shift + R Regenerate

UUIDs, explained

What is a UUID?

A Universally Unique Identifier (UUID) is a 128-bit value written as 32 hexadecimal digits grouped 8-4-4-4-12, such as 550e8400-e29b-41d4-a716-446655440000. The spec that defines them (RFC 4122) describes four bits of the third group as the version and four bits of the fourth group as the variant, which is how tools like this one can tell what kind of UUID they hold.

The value is big enough that independently generated UUIDs are, for all practical purposes, unique across space and time — no central registry is required.

UUID Versions Explained

RFC 4122 defines several versions. v4 relies entirely on randomness: 122 bits come from a cryptographically strong source, which makes collisions effectively impossible but unordered. v7 is time-ordered: the first 48 bits are the milliseconds since the Unix epoch, followed by 74 random bits, so values sort roughly by when they were created.

Older versions — v1 (MAC address and time) and v3/v5 (MD5 or SHA-1 of a name) — exist but see little use today. v6, v7, and v8 add monotonic, timestamp-first layouts that are friendlier to databases.

UUID v4 vs UUID v7

Both are safe choices. v4 gives you maximum unpredictability because every bit is random. v7 trades a little unpredictability for time ordering, which is what databases need when a UUID is a primary key.

The trade-off matters for indexing: a v4 primary key scatters writes across a B-tree, causing page splits and cache churn, while v7 keys insert sequentially, mirroring the row-insertion order.

  • v4: fully random, not sortable, best when ordering is irrelevant.
  • v7: time-ordered, sortable, database-friendly as a primary key.
  • Both are RFC 4122 compliant and safe to use interchangeably.

Database Use Cases

UUIDs shine as primary keys in distributed systems, offline-first apps, and any place where IDs are created on multiple hosts. Merge conflicts vanish because no coordination or auto-increment sequence is needed.

If you store them, use a native uuid or binary(16) column rather than a text column to keep them compact, and prefer v7 when you want index locality.

API Correlation IDs

A correlation ID ties every log line, trace span, and downstream call back to a single user request. Middleware generates one UUID per request, stamps the response header, and every service along the path echoes it.

v7's timestamp makes these IDs broadly sortable, so you can scan a request stream in time order while still keeping global uniqueness.

UUID Security Considerations

A random UUID is unguessable only when 122 bits of true randomness back it (v4 here uses a cryptographically secure source). Treat v1 UUIDs with care — they embed your MAC address and clock, exposing hardware identity and creation time.

Never derive secrets from a UUID. UUIDs are identifiers, not keys. Use them for correlation, references, and identity, and keep real secrets in dedicated key stores.

Generating UUIDs in Modern Applications

Most runtimes ship a trusted generator: browsers expose crypto.randomUUID() and crypto.getRandomValues, Node and Deno follow the same Web Crypto API, and languages like Python, Go, and Rust provide RFC-compliant libraries. This tool uses the browser's native crypto — no network, no keys, nothing leaves your machine.

For bulk work (say 10, 100, or 1,000 at once) the browser generates each in microseconds; this tool renders the batch instantly and lets you switch between List, JSON, and CSV views without regenerating.

When Should You Use UUID v7?

Reach for v7 when you want a primary key with roughly time-sorted inserts, or when events and requests should be sortable in creation order. Reach for v4 when you want maximum entropy and ordering is irrelevant.

Either choice beats sequential integers in distributed systems. Pick v7 by default for new database schemas, and v4 when the value is exposed to clients and must leak nothing about when it was created.

Frequently asked questions

What is a UUID?

A Universally Unique Identifier is a 128-bit value formatted as 32 hex digits in the pattern 8-4-4-4-12, like 550e8400-e29b-41d4-a716-446655440000. Its size makes collisions effectively impossible, so IDs can be created anywhere without a central coordinator.

What is a UUID v4?

UUID v4 is a version of the spec that gets all of its value from randomness: 122 bits come from a cryptographically strong source. It is the most common UUID and is ideal when values need no order. This tool generates v4 values with your browser's native crypto.

What is a UUID v7?

UUID v7 is a time-ordered variant: the first 48 bits are the milliseconds since the Unix epoch, followed by random bits. Because values sort by creation time, v7 is a favorite for database primary keys and event streams that value index locality.

Which UUID version should I use?

Choose v7 for new database schemas or anywhere you want roughly time-ordered inserts. Choose v4 when maximum entropy matters and ordering is irrelevant — for example, when exposing IDs to clients that should not learn what time they were minted.

Can two UUIDs ever collide?

Mathematically collisions are possible, but the odds are negligible: generating v4 UUIDs at a rate of a billion per second for 100 years yields a collision chance far below 50%. For practical purposes, independently generated UUIDs never repeat.

Are UUIDs secure?

Random UUIDs from a cryptographically strong source are unguessable, but they are identifiers, not secrets. Never use a UUID as an encryption key or token. Also avoid v1 UUIDs in sensitive settings because they embed a MAC address and timestamp.

Should databases use UUIDs as primary keys?

Often, yes — especially in distributed or offline-first systems where IDs must be created on many machines without coordination. In single-node relational databases, weigh UUIDs against sequential integers. If you use UUIDs, pick v7 for sorted inserts and store them in a native uuid or binary(16) column.

Why would I remove the hyphens?

Some systems prefer a compact 32-character hex string with no separators, which the Remove hyphens option produces. The value represents exactly the same 128 bits — remove the hyphens whenever a store, file name, or API expects the tighter form.

What is a NIL UUID?

The NIL UUID is every bit zero — 00000000-0000-0000-0000-000000000000. It is the spec's defined 'no value' placeholder and is often used to represent an absent or unset ID.

What is a MAX UUID?

The MAX UUID is every bit one — ffffffff-ffff-ffff-ffff-ffffffffffff. It is the maximum possible UUID value and is sometimes used as a sentinel for 'all' or as an upper bound in range scans.

Can I generate bulk UUIDs?

Yes. Pick a quantity up to 1,000 and press Generate. The tool renders the whole batch instantly in List, JSON, or CSV view, and you can copy everything at once or download a .txt, .json, or .csv file.

Are UUIDs globally unique?

UUIDs are unique by design, not by registry. The 122 bits of randomness in a v4 value (or the timestamp-plus-random layout of v7) gives effective uniqueness across machines, processes, and time, with no central authority assigning them.

How do I check whether a string is a valid UUID?

Paste it into the validator on this page. The tool confirms the 8-4-4-4-12 shape, checks the version nibble and RFC 4122 variant bits, and reports whether it is a valid v4, v7, NIL, or MAX UUID — or explains why it is not.

Does this tool send UUIDs to a server?

No. Generation uses the browser's native crypto.randomUUID() and crypto.getRandomValues, and every check runs locally. Nothing you generate or paste is transmitted, logged, or stored.