UUID Generator

Generate UUIDs

Pick a version, choose how many you need, and they appear immediately. Uppercase and brace-wrapped forms are available for systems that expect them, and the copy button takes the whole list at once.

Everything happens in your browser. Nothing is uploaded, stored or logged, and no identifier is ever written into the page address.

What a UUID is

A UUID is a 128-bit value, written as 32 hexadecimal characters in five hyphen-separated groups:

f47ac10b-58cc-4372-a567-0e02b2c3d479

Its purpose is coordination-free uniqueness. Any machine can produce one at any time, offline, without asking a central service and without checking whether anyone else has used it — and the chance of a duplicate is small enough to ignore. That is what makes UUIDs the default identifier for distributed systems, offline-capable apps, message queues, and anything that has to merge records created in more than one place.

Microsoft calls the same 128-bit format a GUID. The two names are interchangeable; GUIDs are conventionally shown in braces and often uppercase, both of which this tool can produce.

Version 4: random

A version 4 UUID is 122 bits of randomness with six bits spent on the version and variant markers. It carries no information about when, where or by whom it was made.

That is the right default. It leaks nothing, it needs no state, and two generators can never interfere with each other because neither is coordinating in the first place.

Version 7: time-ordered

Version 7 replaces the leading 48 bits with a Unix timestamp in milliseconds, keeping the rest random. Because those bits are the most significant, sorting v7 UUIDs as plain strings puts them in creation order.

That solves a real and frequently expensive problem. Database indexes are ordered structures, and inserting random keys writes to a different place in the index every time — so the working set is the whole index rather than its tail, the cache hit rate collapses, and pages split and fragment. Sequential keys append to one end instead. Teams have discovered this the hard way after a table grows past memory, and switching to v7 is the standard fix.

There is a genuine trade. A version 7 UUID discloses its own creation time, to the millisecond. That is a feature for a primary key and a leak for anything else — a password-reset token, an invitation code, a public object ID whose age you would rather not publish. It also has less randomness than v4, though still far more than any attacker can search.

Generating several v7 UUIDs at once raises a subtlety worth knowing about: a millisecond is a long time, so a batch made in one loop shares a timestamp, and the random remainder would decide their relative order. This tool writes a counter into the bits immediately after the timestamp, exactly as the specification provides for, so a generated list sorts in the order it was produced rather than merely by the millisecond it was produced in.

Could two UUIDs collide?

In principle. In practice, no.

With 122 random bits, you would need to generate roughly 2.7 × 10¹⁸ version 4 UUIDs before the probability of even one duplicate reached one in a billion. At a billion UUIDs per second that is about 85 years of continuous generation.

The mathematics is not the thing to worry about. The random source is. A generator built on an ordinary pseudo-random function can repeat far sooner than the arithmetic suggests, and there are real incidents of exactly that — implementations seeded from the clock producing identical UUIDs on machines that started at the same moment. These are drawn from your browser’s cryptographic random number generator, the same facility that backs encryption keys.

Reading the format

Two characters in a UUID are not random.

The first character of the third group is the version: a 4 or a 7 in the values this tool produces.

The first character of the fourth group is the variant, and is always 8, 9, a or b.

These markers are what make a value a well-formed UUID rather than 32 arbitrary hexadecimal digits, and strict parsers reject anything without them. If you are eyeballing an identifier to work out what produced it, those two positions tell you.

Using a UUID as a secret

A version 4 UUID is unguessable and is a reasonable one-off token — an unsubscribe link, a share URL, a single-use invitation.

A version 7 UUID is not, whenever timing matters. Its creation time is written into it in plain sight, so anyone holding one knows exactly when it was issued, and can narrow the search space for others issued nearby.

For anything that should stay secret over time — an API key, a session token, a password — use a generator built for the job, with a longer value and no structure to reason about.

Frequently asked questions

What is a UUID?

A 128-bit identifier written as 32 hexadecimal characters in five hyphen-separated groups. Its point is that anyone can generate one independently, with no central authority and no coordination, and the chance of two people producing the same value is negligible. GUID is Microsoft's name for the same thing.

What is the difference between version 4 and version 7?

Version 4 is entirely random. Version 7 puts a millisecond timestamp in its leading bits, so v7 values sort into the order they were created. Use v4 by default; use v7 when the identifiers are database keys and insertion order matters.

When should I use version 7?

When UUIDs are primary keys in a database. Random v4 keys scatter inserts across the whole index, so each write touches a different page and the index fragments. v7 keys append in order, which keeps recent data together and inserts fast. The trade is that a v7 UUID reveals when it was created.

Can two UUIDs ever be the same?

In principle yes, in practice no. A v4 UUID carries 122 random bits. You would need to generate around 2.7 × 10¹⁸ of them before reaching a one-in-a-billion chance of a single collision — roughly a billion a second for 85 years. The real risk is not chance but a weak random source, which is why these are drawn from your browser's cryptographic generator.

Are UUIDs safe to use as secret tokens?

A version 4 UUID is unguessable and reasonable as a one-off token. A version 7 UUID is not, for anything time-sensitive: its creation time is written into it in plain sight, and the remaining randomness is lower. For passwords or long-lived secrets, use a purpose-built generator.

What do the fixed characters mean?

The first character of the third group is the version — 4 or 7 here. The first character of the fourth group is always 8, 9, a or b, and marks the variant. They are not random; they are what make the value a well-formed UUID rather than 32 arbitrary hex digits.

Is anything sent to a server?

No. Identifiers are generated in your browser using its cryptographic randomness, and are never uploaded, stored, logged or written into the page address.