UUID Generator
Generate UUIDs / GUIDs instantly — random version 4, time-based version 1, deterministic name-based version 5, or the NIL UUID. Bulk up to 1000, format them with uppercase, hyphens, braces or a urn:uuid: prefix, and paste any UUID into the validator to read its version and variant. Everything runs in your browser; nothing is uploaded.
Validate & inspect a UUID
Generated entirely in your browser — never sent anywhere. Randomness comes from the browser's cryptographic RNG (crypto.getRandomValues).
What this tool is
- A free, in-browser UUID (GUID) generator: version 4 (random) by default, plus version 1 (time-based), version 5 (name-based, SHA-1) and the NIL all-zero UUID.
- Bulk-generate from 1 to 1000 at once, copy any row or all of them, or download the batch as a .txt file.
- Format exactly how you need it: uppercase or lowercase, with or without hyphens, wrapped in braces {…}, or as a urn:uuid: URN.
- Paste any UUID into the validator to read back its version and RFC 4122 variant — it accepts hyphenated, unhyphenated, braced, URN and mixed-case spellings.
- Everything runs client-side using the browser’s cryptographic RNG (crypto.getRandomValues / crypto.randomUUID). Nothing you generate is ever sent to a server.
What is a UUID?
A UUID (Universally Unique Identifier) — called a GUID (Globally Unique Identifier) by Microsoft — is a 128-bit value used to identify something uniquely without any central registry. It is written as 32 hexadecimal digits in five groups, 8-4-4-4-12, like 123e4567-e89b-12d3-a456-426614174000. Because 128 bits is an enormous space, independently generated UUIDs effectively never collide, which is why they are everywhere: database primary keys, distributed record IDs, request and trace IDs, object-storage keys and session identifiers.
The versions, briefly
- Version 1 — time-based. Encodes a 60-bit timestamp (100-ns intervals since 1582), a clock sequence and a node. Roughly time-ordered, which helps index locality — but classic v1 leaks the machine's MAC address and creation time.
- Version 3 & 5 — name-based. Deterministic: hash a namespace UUID with a name (v3 uses MD5, v5 uses SHA-1). The same input always yields the same UUID. v5 is preferred — SHA-1 beats MD5.
- Version 4 — random. 122 random bits from a CSPRNG. Unguessable and leak-free. This is the default you want almost everywhere.
- NIL. The special all-zero UUID (
00000000-0000-0000-0000-000000000000), used as a placeholder or "no value".
Version & variant bits
Not every bit is random. Four bits (the first hex digit of the third group) record the version, so a v4 UUID always has a 4 there. The top bits of the fourth group encode the variant; for RFC 4122 UUIDs that digit is 8, 9, a or b. The validator in this tool reads both back from any UUID you paste.
Collision probability
A v4 UUID has 122 random bits — about 5.3×1036 values. By the birthday bound you would need to generate roughly 2.7×1018 UUIDs before reaching a 50% chance of one collision. Generating a billion per second for about 85 years still leaves only a one-in-a-billion chance of a single duplicate — provided the randomness is a real CSPRNG, which is what the browser's crypto.getRandomValues gives you.
When to use which
- Default to v4. For public-facing IDs, tokens or anything a user might see or guess, use v4 — it is unpredictable and reveals nothing.
- v1 only when ordering helps and leakage is acceptable. Time-ordered IDs can improve B-tree insert locality, but weigh that against the embedded timestamp. This tool's v1 uses a random node (multicast bit set) so no MAC is leaked.
- v5 for stable IDs from a name. When you need the same input to always map to the same UUID (e.g. an ID derived from a URL), use v5. Remember it is deterministic, so it is not a secret.
Security note: Use v4 whenever an identifier must be unguessable — a v1 UUID embeds its creation time (and a real-MAC v1 leaks the host's hardware address), so it is a poor choice for session tokens, password-reset links or anything an attacker could enumerate. A UUID of any version is an identifier, not a credential: it provides no confidentiality and should never stand in for authentication or a secret key.
Frequently asked questions
What is a UUID?
A UUID (Universally Unique Identifier), also called a GUID (Globally Unique Identifier) in the Microsoft world, is a 128-bit value used to label something uniquely without a central authority handing out IDs. It is written as 32 hexadecimal digits in five hyphen-separated groups, for example 123e4567-e89b-12d3-a456-426614174000. The 128 bits are large enough that independently generated UUIDs are, for practical purposes, guaranteed not to collide, which is why they are used for database primary keys, distributed-system record IDs, request/trace IDs, file and object names, and session tokens.
Are UUIDs really unique?
Not mathematically guaranteed, but unique for all practical purposes. A version 4 UUID has 122 random bits (6 bits are fixed for the version and variant), giving about 5.3 x 10^36 possibilities. You would need to generate roughly 2.7 x 10^18 of them before the probability of a single collision reached even 50% (the birthday bound). In concrete terms, generating a billion UUIDs per second for about 85 years gives you around a one-in-a-billion chance of one duplicate. For any normal application that is effectively never — provided the random source is a real CSPRNG, which is exactly what this tool uses.
What is the difference between UUID v4 and v1?
Version 4 is purely random: every usable bit comes from a cryptographic random number generator, so the value is unguessable and leaks nothing about when or where it was made — this is the right default for public-facing or security-sensitive IDs. Version 1 is time-based: it encodes a 60-bit timestamp (100-nanosecond intervals since 1582) plus a clock sequence and a node identifier. That makes v1 roughly time-ordered, which can help database index locality, but the classic v1 leaks the generating machine’s MAC address and creation time. This tool’s v1 uses a random node with the multicast bit set instead of a real MAC, so it does not leak hardware identity, but v1 still embeds the creation time. Prefer v4 when unpredictability matters.
What are v3 and v5 UUIDs, and are they private?
Versions 3 and 5 are name-based and deterministic: they hash a namespace UUID together with a name (v3 uses MD5, v5 uses SHA-1) and stamp the version and variant bits into the result. The same namespace and name always produce the same UUID, which is useful for generating a stable ID from an existing identifier such as a URL or domain. v5 is generally preferred over v3 because SHA-1 is stronger than MD5. Because the input is hashed, the name is not directly recoverable, but a deterministic UUID is not a secret — anyone who guesses the namespace and name can recompute it. All generation here, including the SHA-1 and MD5 hashing, happens in your browser; nothing is transmitted.