Random & security tools

UUID generator (v4 and v7)

Create random version 4 UUIDs or time-ordered version 7 UUIDs, one or a thousand at a time, in lowercase, uppercase, without hyphens or in braces. Paste an existing UUID below to see which version it is and, for time-based UUIDs, when it was created.

Inspect a UUID

Runs entirely in your browser. Nothing you enter here is uploaded.

How to generate UUIDs

  1. Choose v4 for a random identifier, or v7 if the UUIDs will be database keys or need to sort by creation time.
  2. Enter how many you need, from 1 to 1,000.
  3. Pick a format: lowercase with hyphens is the standard form; Uppercase, No hyphens and In {braces} match systems that expect those styles, such as older Microsoft tools.
  4. Press Generate, then Copy the list or Download it as a text file, one UUID per line.
  5. To check an existing UUID, paste it into Inspect a UUID. Hyphens, braces, uppercase and a urn:uuid: prefix are all accepted.

How UUIDs work

A UUID is a 128-bit number written as 32 hexadecimal digits in five groups, 8-4-4-4-12. The current standard is RFC 9562, published in 2024, which replaced RFC 4122 and added versions 6, 7 and 8. Two fields are fixed in every standard UUID: the first digit of the third group is the version, and the first digit of the fourth group is always 8, 9, a or b, which marks the variant.

Version 4: random

Apart from those 6 fixed bits, a v4 UUID is 122 random bits. This page takes them from the browser's cryptographic random number generator, the same source as crypto.randomUUID. The number of possible values is so large that collisions are not a practical concern: you would need to generate about 2.71 × 10^18 UUIDs before the chance of any two matching reached one half.

Version 7: time-ordered

A v7 UUID starts with a 48-bit Unix timestamp in milliseconds, followed by the version, 74 random bits and the variant. Because the time comes first, v7 UUIDs sort in the order they were created. That matters for databases: random v4 keys are inserted all over a B-tree index, while v7 keys are appended at the end, which keeps indexes compact and inserts fast. PostgreSQL 18 added a built-in uuidv7() function for this reason. The 48-bit timestamp lasts until the year 10889.

When many v7 UUIDs are generated in the same millisecond, this tool treats the random part as a counter and adds one for each new UUID, one of the methods RFC 9562 describes, so a batch is always in strictly increasing order.

Reading a UUID

The inspector reads the version and variant digits, and for versions 1, 6 and 7 decodes the embedded timestamp. Versions 1 and 6 count 100-nanosecond intervals since 15 October 1582, the start of the Gregorian calendar; version 7 counts milliseconds since 1970. The Nil UUID (all zeros) and Max UUID (all ones) are special values defined by the standard.

Examples

These are the example UUIDs from RFC 9562's appendix, all created at the same moment, 22 February 2022 19:22:22 UTC:

UUIDWhat the inspector shows
C232AB00-9414-11EC-B3C8-9F6BDECED846Version 1, created 2022-02-22 19:22:22 UTC
017F22E2-79B0-7CC3-98C4-DC0C0C07398FVersion 7, created 2022-02-22 19:22:22 UTC
919108F7-52D1-4320-9BAC-F847DB4148A8Version 4, no timestamp
00000000-0000-0000-0000-000000000000Nil UUID

In the v7 example, the first 12 digits, 017F22E279B0, are the hexadecimal form of 1645557742000 — the number of milliseconds from 1970 to that moment. The 7 after the second hyphen is the version, and the 9 after the third is the variant.

The same v4 UUID in the four formats: 919108f7-52d1-4320-9bac-f847db4148a8, 919108F7-52D1-4320-9BAC-F847DB4148A8, 919108f752d143209bacf847db4148a8 and {919108f7-52d1-4320-9bac-f847db4148a8}. All four decode to the same value.

Limits

  • Up to 1,000 at a time. Larger requests are capped; generate again for more.
  • v7 reveals the creation time to anyone who sees the UUID. Use v4 for identifiers that appear in public URLs if the timing of, say, account creation should stay private.
  • v7 relies on your clock. If the device clock is wrong, the timestamps are wrong, and UUIDs generated on different machines are only as well ordered as their clocks.
  • Versions 1, 3, 5, 6 and 8 are decoded but not generated. v1 and v6 embed a device identifier; v3 and v5 are derived from a name and should be created by the system that owns that name space.

Frequently asked questions

Should I use UUID v4 or v7?

Use v7 for database primary keys and anything that benefits from sorting by time. Use v4 when the identifier should not reveal when it was created.

Can two UUIDs ever be the same?

In theory, yes; in practice, no. With 122 random bits you would need around 2.71 × 10^18 v4 UUIDs for a 50% chance of a single duplicate.

Is a UUID the same as a GUID?

Yes. GUID is Microsoft's name for the same 128-bit format; Microsoft tools often write it in uppercase and in braces.

Are UUIDs safe to use as secret tokens?

A v4 UUID from a cryptographic generator is unguessable, but it is not designed as a secret. For session or reset tokens, prefer a purpose-built random token.

Are these UUIDs generated on a server?

No. They are generated in your browser using its cryptographic random number generator and are never sent anywhere.

Sources and further reading

↵ to open · Esc to close