UUID Generator

About UUID Generator

A UUID is a 128-bit identifier designed so that independent systems can mint IDs without asking a central server and still not collide. The format was specified in RFC 4122 in 2005; in May 2024 RFC 9562 replaced it and added versions 6, 7 and 8.

This tool generates version 4, the random kind. It draws 16 bytes from the browser's crypto.getRandomValues, then fixes the version nibble (the 13th hex character) to 4 and the variant bits so the 17th character is 8, 9, a or b. You can make up to 1,000 at once and switch to uppercase or the 32-character form without hyphens.

Reading a UUID string

In 2d7f7b60-80d6-4402-8639-8e0992715d01, the first character of the third group, 4, is the version. The first character of the fourth group, 8, carries the variant, which marks the value as following the RFC layout; for standard UUIDs it is always 8, 9, a or b. Take away those fixed bits and 122 of the 128 bits are random.

RFC 9562 says hex digits should be output in lowercase and treated as case-insensitive on input. The uppercase option exists for older systems that expect it, such as some Windows tooling that prints GUIDs in capitals with braces. The hyphen-free form is the same value; what matters is picking one representation if you store UUIDs as text, or string comparisons will disagree about identical IDs.

The collision math, with real numbers

With 122 random bits there are 2^122, about 5.3×10^36, possible values. Using the birthday approximation p ≈ 1 − e^(−n²/2N): after generating one billion (10^9) UUIDs, the chance that any two match is about 9.4×10^−20. After a trillion it is about 9.4×10^−14. To reach a 50% chance of a single collision you would need roughly 2.7×10^18 UUIDs, which at a billion per second takes about 86 years.

That figure assumes a proper random source. Real-world duplicate UUIDs almost always come from implementation mistakes rather than bad luck: cloned virtual machines that resume with the same RNG state, generators seeded from the clock, non-cryptographic functions like Math.random, or a hard-coded test value left in production. This tool never falls back to Math.random: without the Web Crypto API it disables the generate button and says why, though every current browser provides Web Crypto.

v4 or v7 for a database primary key

UUIDv7 puts a Unix timestamp in milliseconds in the top 48 bits and fills the remaining 74 bits (after version and variant) with random data or an optional counter for strict ordering. Values created later sort later, both as bytes and as text. RFC 9562 recommends v7 over v1 and v6 wherever possible.

The practical difference shows up in B-tree indexes. Random v4 keys land all over the index, so inserts keep touching different pages, splitting them and pulling cold pages into memory. Sequential v7 keys append near the right-hand edge of the index, behaving much like an auto-increment integer. The RFC itself notes that non-time-ordered UUIDs are not close to each other in the index and cite performance effects of an order of magnitude or more for time-ordered alternatives.

The trade-off is that v7 exposes when a record was created. For public-facing identifiers such as customer IDs or order numbers, where you may not want to reveal signup dates or growth rate, v4 is the more private choice. This tool only produces v4; generate v7 in your database or with your language's UUID library.

Should a UUID be a secret token?

Guessing a well-generated v4 is impractical, but RFC 9562 advises against assuming UUIDs are hard to guess or using them as security capabilities. Not every implementation uses a cryptographic source, and versions like v1 and v7 have predictable portions. For password-reset links or API keys, use a token generator built for that purpose.

Worked examples

How to use it

1. Enter how many UUIDs you need (1 to 1,000).
2. Choose uppercase or no-hyphen output only if the target system requires it; lowercase with hyphens is the standard form.
3. Copy the list and paste it where you need it.

Frequently asked questions