Everyday Utilities Free · No signup · Private · Instant results

UUID Generator

Generate version 4 UUIDs per RFC 4122 — single or bulk mode.

Number of UUIDs

UUID Version

Output Case

Microsoft-style braces

Wrap in {braces}

Strip hyphens

Remove dashes (32 hex chars only)

About the UUID Generator

A UUID (Universally Unique Identifier) is a 128-bit label that needs no central registrar to guarantee uniqueness. Originally specified in RFC 4122 (2005), the format was revised and extended in RFC 9562 (May 2024), which introduced version 7 (time-ordered) and deprecated the MAC-address-leaking version 1. Version 4 — the one you almost certainly want — carries 122 bits of randomness drawn from a CSPRNG, yielding collision probability low enough to ignore at any realistic scale.

UUIDs show up in nearly every layer of modern software: as database primary keys in Postgres and MySQL, as object keys in S3-compatible storage, as jti claims in JWT tokens, as message IDs in Kafka and RabbitMQ, and as correlation IDs tracing requests across microservices. The 8-4-4-4-12 hex format is instantly recognizable to any developer, and the lexicographic sortability of v7 makes it ideal for time-series data.

This generator runs entirely in your browser using the Web Crypto API. No UUID is sent over the network, so it is safe to use for pre-generating API tokens, seeding test fixtures, or producing nonces for OAuth flows before committing them to a database.

How It Works

A v4 UUID is built from 16 random bytes obtained via crypto.getRandomValues(new Uint8Array(16)). Two nibbles are then overwritten to encode version and variant: byte 6’s high nibble is set to 0x4 (the version), and byte 8’s high bits are set to 10 (the RFC 9562 variant, which constrains the value to 8, 9, A, or B). The remaining 122 bits are pure randomness. The canonical layout is xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx, where M encodes the version and N encodes the variant.

Version 7 (RFC 9562 §5.7) replaces the first 48 bits with a millisecond Unix timestamp. This makes v7 UUIDs monotonically increasing when generated in the same process — a property that lets databases cluster-insert rows in time order without a separate created_at index. The remaining 74 bits (12 bits of sub-millisecond randomness plus 62 bits of pure random) provide uniqueness within the same millisecond.

The 50% collision threshold for v4 UUIDs is 2⁶¹ ≈ 2.31 × 10¹⁸ draws — the birthday-paradox bound. To reach even one collision in practice you would need to generate roughly 103 trillion UUIDs per second for a full year. Postgres stores UUIDs as a 16-byte native type, making them marginally faster to index than a 36-character string.

Optional formatting toggles wrap the output in {braces} (the Microsoft SQL Server convention), strip hyphens to produce a compact 32-character hex string (useful in URL-safe contexts), or uppercase the hex digits (Oracle’s RAW(16) convention).

Worked Examples

A typical v4 output is 550e8400-e29b-41d4-a716-446655440000. The 4 in position 14 (the third group’s leading hex digit) is the version; the a in position 19 encodes the variant. Strip the hyphens and you get 550e8400e29b41d4a716446655440000 — 32 hex characters, 128 bits.

A v7 UUID generated at timestamp 1700000000000 starts with 18b6c4a0-e29b-7xxx-.... The leading 12 hex digits encode the millisecond timestamp in big-endian form, so sorting UUIDs lexicographically also sorts them chronologically — a property that v4 lacks.

The Nil UUID 00000000-0000-0000-0000-000000000000 is a valid UUID defined by RFC 9562 §5.6 for use as a sentinel value meaning ‘no UUID assigned’ — useful in protobuf schemas and for representing ‘not yet set’ in nullable foreign-key columns.

When to Use This Tool

Database primary keys in Postgres, MySQL, or SQLite where auto-increment would leak row counts.
Distributed-system message IDs in Kafka, RabbitMQ, or NATS where multiple producers need non-colliding keys.
jti (JWT ID) claims in OAuth/OIDC tokens to prevent replay attacks.
S3-style object keys when you do not want sequential filenames guessable by attackers.
Correlation IDs in distributed tracing (OpenTelemetry, Jaeger, Zipkin).
Test fixtures that need unique-but-stable IDs across runs.
Pre-generating API tokens that get committed to a secrets manager before deployment.

Limitations & Disclaimer

This generator uses the Web Crypto API’s CSPRNG and follows RFC 9562 for version and variant bits. It does not guarantee global uniqueness the way v1 with a MAC address did — v4 uniqueness is probabilistic, with collision probability vanishingly small but nonzero. UUIDs are identifiers, not security tokens: they carry no signature and can be forged by anyone. For session tokens, API keys, or anti-replay nonces, use a signed JWT, HMAC, or the dedicated Random String Generator with an appropriate token preset. See our disclaimer for full terms.

Frequently Asked Questions

What is the difference between RFC 4122 and RFC 9562?

RFC 9562 (May 2024) obsoletes RFC 4122. It clarifies the security requirement to use a CSPRNG for v4, introduces v6 (reordered v1 with timestamp first) and v7 (time-ordered with millisecond Unix timestamp), and v8 (vendor-specific). The v4 wire format is unchanged, so existing UUIDs remain valid.

What is the probability of a UUID collision?

For v4 with 122 random bits, the birthday-paradox 50% threshold is <code>261 ≈ 2.31 × 1018</code> UUIDs. To reach even one collision you would need to generate ~103 trillion UUIDs per second for a year. For any realistic workload, collisions are effectively impossible. See RFC 9562 §6.

Should I use v4 or v7 for database primary keys?

v7 if your database benefits from time-ordered inserts (Postgres B-tree, DynamoDB sort keys, MongoDB <code>_id</code>). v4 if you need to avoid leaking creation time (privacy-sensitive records). Both have 122 bits of randomness; v7 just front-loads a timestamp.

Are these UUIDs safe to use as session tokens?

v4 UUIDs have 122 bits of randomness, which is sufficient entropy for session tokens. However, UUIDs are not unforgeable — they have no cryptographic signature. For session tokens, prefer a signed JWT or HMAC’d random value so the server can detect tampering.

Why does the UUID have hyphens if they are not significant?

Hyphens are purely cosmetic — they make the string easier for humans to read and copy. RFC 9562 §4 specifies the 8-4-4-4-12 layout. The optional ‘strip hyphens’ toggle removes them to produce a 32-character hex string for compact storage or URL-safe use.

Can I use crypto.randomUUID() instead?

Yes. Modern browsers expose <code>crypto.randomUUID()</code>, which returns a v4 UUID directly. This generator uses the lower-level <code>getRandomValues</code> API so it can also produce v7, nil, and formatted output, and works in older browsers that lack <code>randomUUID</code>.

Last updated: September 9, 2026 · Author: HT99 Tools Editorial Team