UUID Generator

UUID versions: randomness, time, and namespaces

v4 is random (RFC 4122); v1 is time/MAC-derived (privacy concerns on some networks); v5 hashes a namespace + name. Choose v4 for opaque IDs unless you need sortable time proximity.

Database uniqueness still needs constraints—collision probability is tiny but not a substitute for transactional checks.

What each option produces

• Version 4 (default): 122 random bits from your browser’s cryptographically secure generator, plus the fixed version and variant bits. This is the right choice for almost every new identifier.
• Version 1: built from the current time as the count of 100-nanosecond intervals since 15 October 1582 (the start of the Gregorian calendar), a random clock sequence, and a random 48-bit node ID with the multicast bit set. Classic v1 used the computer’s network MAC address as the node; the random node keeps your hardware address out of the ID, as RFC 9562 recommends.
• Nil UUID: all zeros (00000000-0000-0000-0000-000000000000), used as an explicit “no value” marker.
• Formatting: generate up to 50 at once, switch to uppercase, or remove the hyphens to get a 32-character hex string.

Reading a UUID

A UUID is 128 bits written as 32 hexadecimal digits in five groups (8-4-4-4-12):

f47ac10b-58cc-4372-a567-0e02b2c3d479
              ^    ^
              |    variant: 8, 9, a or b = RFC 9562 layout
              version: 4 = random

The first digit of the third group is always the version, and the first digit of the fourth group shows the variant. That is why a v4 UUID always has a 4 in the 13th position, and why only 122 of the 128 bits are random. For a v1 UUID the first three groups hold the timestamp, so anyone can read off when it was created — something to keep in mind before exposing v1 IDs publicly.

Which version should you use?

• v4 for general identifiers: API resource IDs, file names, idempotency keys, correlation IDs in logs.
• v7 for new database primary keys: defined in RFC 9562 (2024), it starts with a Unix-millisecond timestamp, so values sort in creation order and index far better than random v4 keys in B-tree indexes. This tool does not generate v7 yet; most languages have a maintained library for it.
• v1 when an existing system expects it, for example some older Cassandra schemas (TimeUUID).
• v5 when the same input must always produce the same ID (it hashes a namespace and a name with SHA-1). Not offered here because it needs those inputs.

Will two UUIDs ever collide?

For v4, the 50% collision point arrives at about 2.7 × 10¹⁸ generated IDs — roughly 86 years of producing a billion UUIDs every second. In practice, a duplicate is far more likely to come from a bug, such as a copied ID or a badly seeded generator in another system, than from chance. Keep a unique constraint on the database column anyway; it costs nothing and catches the bugs.

Unpredictable is not the same as secret. RFC 9562 advises against assuming UUIDs are hard to guess, so do not use one as a password-reset or session token — use a dedicated random token instead.

Storing and comparing UUIDs

• Use a native type where one exists — uuid in PostgreSQL, uniqueidentifier in SQL Server — or BINARY(16) in MySQL. Storing the 36-character string takes more than twice the space and slows indexes.
• Compare case-insensitively: f47ac10b… and F47AC10B… are the same UUID. Microsoft tools traditionally show GUIDs in uppercase, often wrapped in braces {…}.
• Hyphen-free 32-character strings are common in URLs and file names. Most parsers accept both forms, but be consistent within one system.

Generating UUIDs in code

When you need IDs at runtime rather than a handful to paste, every mainstream platform has a built-in v4 generator:

JavaScript   crypto.randomUUID()            // browsers (HTTPS) and Node.js
Python       import uuid; uuid.uuid4()
Java         java.util.UUID.randomUUID()
C# / .NET    Guid.NewGuid()
PostgreSQL   SELECT gen_random_uuid();      -- built in since v13
Go           uuid.New()                     // github.com/google/uuid
Shell        uuidgen                        # macOS prints uppercase

In their current implementations these use the operating system’s secure random source, like this page does. Avoid hand-rolled versions built on Math.random(), which older code snippets online still copy around.