UUID Generator

What is a UUID?

A UUID (universally unique identifier) is a 128-bit value used to label something, such as a database row, an uploaded file, a message on a queue or a device, without asking a central server for the next free number. Any program can create one at any time, even offline, and the chance that two independently created UUIDs are equal is small enough to ignore.

As text, a UUID is 32 hexadecimal digits in five groups separated by hyphens, 8-4-4-4-12, for 36 characters in all:

3f2b8c1e-9d4a-4e7b-b5c6-0a1d2e3f4a5b

The format is defined by RFC 9562, which the IETF published in May 2024. It replaced RFC 4122 from 2005, kept every existing UUID valid, and added versions 6, 7 and 8 and the Max UUID. The same format is also published as ITU-T X.667 and ISO/IEC 9834-8. Microsoft calls it a GUID (globally unique identifier); more on that below.

Why not just use an auto-increment integer? Because UUIDs can be made anywhere: in the browser before a form is saved, on several database shards at once, or in an offline mobile app that syncs later. Nothing has to coordinate, and merging data from two systems never produces clashing IDs. The cost is size (16 bytes instead of 4 or 8) and, for random versions, keys that arrive in no particular order.

UUID versions compared

The version is a single hex digit inside every UUID. It tells you how the other bits were chosen. This generator makes all of the versions below except v8, which has no fixed layout.

Version 2, "DCE Security," is reserved for an old Distributed Computing Environment scheme that embeds a POSIX user or group ID. RFC 9562 leaves its layout to the DCE specification, almost nothing uses it, and this tool does not make it.

When this generator makes several v7 UUIDs in the same millisecond, it increments the random part instead of drawing it again, one of the methods RFC 9562 section 6.2 describes, so every value it gives you sorts strictly after the one before. For v1 and v6 it uses a random node ID with the multicast bit set, the option RFC 9562 gives for when a MAC address should not be used; a web page cannot read your MAC address anyway.

Which UUID version should I use?

v4: the safe default

If you need an opaque ID and do not care about order, use a random v4 UUID. Every mainstream language and database can make one, it reveals nothing about when or where it was created, and its collision odds are covered below.

v7: database primary keys

Most databases index a primary key with a B-tree, which keeps the keys in sorted order. Random v4 keys land on random leaf pages, so every insert into a large table touches a different part of the index. That means more page splits, more cache misses, more data written per row and a larger, more fragmented index. In MySQL's InnoDB the primary key is the clustered index, so the table itself is stored in key order and the effect is even larger.

A v7 UUID starts with a millisecond timestamp, so new keys arrive in roughly ascending order and land at the right-hand edge of the index, much like an auto-increment integer. You keep the main benefit of UUIDs, since any server or client can create one without coordination, and lose most of the indexing penalty. As a bonus, sorting by ID roughly sorts by creation time.

The trade-off: anyone who sees a v7 UUID can read when it was created, to the millisecond. If the creation time of a record is sensitive, such as when a user signed up, expose a v4 UUID publicly and keep the v7 key internal.

v5: the same ID from the same name

Name-based UUIDs are deterministic. Hash the same namespace and name and you always get the same UUID, on any machine, in any language. Version 5 of the name example.com in the DNS namespace is always cfbff0d1-9375-5685-968c-48ce8b15ae17. That is useful for de-duplicating records, deriving an ID for an external object such as a URL or an email address, or making imports safe to run twice. Prefer v5 (SHA-1) over v3 (MD5); RFC 9562 says the same. Remember that anyone who knows the name can compute the UUID, so it is not a secret.

v1 and v6: only for existing systems

Version 1 sorts badly and, from older generators, leaks a MAC address. Version 6 fixes the ordering but exists mainly so systems already built on v1 can switch with little change. RFC 9562 says new systems should use v7 instead.

Whatever you pick, store UUIDs in a native type rather than as text: uuid in PostgreSQL, BINARY(16) in MySQL, uniqueidentifier in SQL Server. A 16-byte value is less than half the size of a 36-character string, and comparisons are faster.

UUID vs GUID: is there a difference?

Not in the value. GUID is Microsoft's name for the same 128-bit identifier, used across Windows, COM, .NET and SQL Server. A GUID from Guid.NewGuid() in .NET or NEWID() in SQL Server is a version 4 UUID with the standard variant, so a GUID generator and a UUID generator produce the same thing. A few practical differences remain:

• Presentation. Windows tools often show GUIDs in uppercase inside braces, such as {3F2B8C1E-9D4A-4E7B-B5C6-0A1D2E3F4A5B}. Turn on Uppercase and Braces in the generator above to get that form.
• Byte order. As 16 raw bytes, the Windows GUID structure and .NET's Guid.ToByteArray() store the first three groups little-endian, while RFC 9562 uses big-endian order throughout. The text is identical; the bytes are not. This matters when you move binary GUIDs between .NET or SQL Server and other systems.
• Variant. The variant field reserves a value for Microsoft's early GUIDs. Modern GUIDs use the standard RFC variant, and the decoder tells you which one a value has.

Anatomy of a UUID

Every UUID follows the pattern xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx. Two digits tell you what kind it is, wherever it came from:

• M, the version: the first digit of the third group. A 4 means random, a 7 means Unix-time ordered, and so on.
• N, the variant: the first digit of the fourth group. 8, 9, a or b is the RFC 9562 variant that every modern generator uses. 0 to 7 is the old NCS variant, c or d is Microsoft's reserved range, and e or f is reserved for the future.

Here is a version 7 UUID taken apart:

01a12525-da3b-7c4e-9f21-6d3e0a8b5c47

That adds up to 48 timestamp bits, 4 version bits, 2 variant bits and 74 random bits. Paste the example into the Validate & decode tab and the decoder shows the same breakdown, with the time in your own time zone. In a v4 UUID the same positions hold the version and variant, and everything else is random.

How random is a UUID? The collision math

A v4 UUID fixes 6 of its 128 bits, which leaves 122 random bits and 2¹²² ≈ 5.3 × 10³⁶ possible values. The question that matters is the birthday problem: after generating n UUIDs, what is the chance that any two of them match? For a space of size N it is approximately

p(n) ≈ 1 − e^(−n² / 2N)
N    = 2^122

p = 0.5  →  n ≈ √(2 · ln 2 · 2^122)
              ≈ 2.71 × 10^18

So you need about 2.71 quintillion v4 UUIDs before a single duplicate becomes as likely as not. At one billion UUIDs per second, that takes about 86 years, and storing them as 16-byte values would take around 43 exabytes.

Those numbers assume a good random source. Real-world duplicates come from bugs: a non-cryptographic generator seeded the same way on many machines, a virtual machine cloned together with its random state, or code that copies an ID where it should create a new one. For v7, only UUIDs created in the same millisecond can collide, and each millisecond has 74 random bits of its own. This page draws its randomness from the browser's cryptographically secure generator, which the operating system seeds.

Generate a UUID in code

Most platforms can make a UUID without extra packages. Each example below uses an API that ships with the language or with a widely used library, as noted in the comments.

// Browsers (on HTTPS or localhost) and Node.js 19+
const id = crypto.randomUUID()   // '9b2e4c4e-5d1a-4f7e-8a3c-2f0d6b1e7a94'

// Node.js 14.17 and later, any module
import { randomUUID } from 'node:crypto'
randomUUID()

// Version 7: the uuid package (npm install uuid)
import { v7 as uuidv7 } from 'uuid'
uuidv7()

import uuid

uuid.uuid4()          # random
uuid.uuid7()          # time-ordered, Python 3.14+
str(uuid.uuid4())     # as a lowercase string

# Name-based: always UUID('cfbff0d1-9375-5685-968c-48ce8b15ae17')
uuid.uuid5(uuid.NAMESPACE_DNS, "example.com")

import java.util.UUID;

UUID id = UUID.randomUUID();       // version 4
String text = id.toString();       // lowercase, hyphenated
int version = UUID.fromString(text).version();

// Version 7: JDK 26 and later; older JDKs need a library
UUID v7 = UUID.ofEpochMillis(System.currentTimeMillis());

Guid id = Guid.NewGuid();            // version 4
Guid v7 = Guid.CreateVersion7();     // .NET 9 and later
string text = id.ToString();         // lowercase, hyphenated ("D" format)
string windows = id.ToString("B").ToUpperInvariant();  // {…} in uppercase

import "github.com/google/uuid"

id := uuid.New()             // version 4; panics if the random source fails
v7, err := uuid.NewV7()      // time-ordered
parsed, err := uuid.Parse("01a12525-da3b-7c4e-9f21-6d3e0a8b5c47")

use Ramsey\Uuid\Uuid;                            // composer require ramsey/uuid
use Symfony\Component\Uid\Uuid as SymfonyUuid;   // composer require symfony/uid

$id = Uuid::uuid4()->toString();
$v7 = Uuid::uuid7()->toString();
$v7 = SymfonyUuid::v7()->toRfc4122();

SELECT gen_random_uuid();   -- version 4, built in since PostgreSQL 13
SELECT uuidv7();            -- version 7, PostgreSQL 18+

CREATE TABLE orders (
  id         uuid PRIMARY KEY DEFAULT uuidv7(),
  created_at timestamptz NOT NULL DEFAULT now()
);

-- PostgreSQL 18: read the version and the embedded time back
SELECT uuid_extract_version(id), uuid_extract_timestamp(id) FROM orders;

SELECT UUID();   -- version 1 (time-based), not random

-- Store 16 bytes. The second argument (1) swaps the time-low and time-high
-- groups, so values made by UUID() arrive in roughly ascending order.
INSERT INTO events (id) VALUES (UUID_TO_BIN(UUID(), 1));
SELECT BIN_TO_UUID(id, 1) FROM events;

uuidgen                                   # macOS and Linux; macOS prints uppercase
uuidgen | tr '[:upper:]' '[:lower:]'      # force lowercase
cat /proc/sys/kernel/random/uuid          # Linux, no extra tools
python3 -c 'import uuid; print(uuid.uuid4())'

# PowerShell on Windows
[guid]::NewGuid()

Validate a UUID with a regular expression

A pattern can check the shape of a UUID. The first accepts any 8-4-4-4-12 hex string, including Nil and Max. The second also requires version 1 to 8 and the RFC 9562 variant, which rejects most strings that only look like UUIDs.

// Any version and variant
/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i

// Versions 1–8 with the RFC 9562 variant
/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i

How this UUID generator works, and why nothing leaves your device

Every UUID on this page is created by JavaScript running in your own browser tab. The random bits come from the Web Crypto API, crypto.getRandomValues, plus crypto.randomUUID for v4 where the browser has it. The MD5 and SHA-1 hashing for v3 and v5 runs on the page as well, so the names you type stay on your device too.

• Nothing is uploaded. The tool has no code that sends data anywhere, and the page's Content-Security-Policy only allows connections back to this site. Open your browser's developer tools, choose the Network tab and generate a few thousand UUIDs: no request appears.
• It keeps working offline. Once the page has loaded, you can disconnect and keep generating, validating and decoding, because none of it needs a server.
• No account. The tool sets no cookies. It remembers your last tab, version and format options in your browser's local storage, on your device only.
• No MAC address. Version 1 and 6 UUIDs get a random node ID, so they never contain hardware details.