UUID v4 · v5 · v7 · GUID
UUID Generator
Generate UUIDs for database keys, request IDs and test data: random v4, time-ordered v7 or name-based v5 - one at a time or in bulk, created locally in your browser.
xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
Generated in your browser with crypto.randomUUID(). Nothing is sent or stored. Verify it
What Is a UUID?
A UUID (universally unique identifier) is a 128-bit value written as 32 hexadecimal digits in five groups, for example 36b8f84d-df4e-4d49-b662-bcde71a8764f. It is defined in RFC 9562, which replaced RFC 4122 in 2024.
Version 4 is the random version. Of the 128 bits, 6 are fixed: the 13th digit is always 4 (the version) and the 17th is always 8, 9, a or b (the variant). The other 122 bits are random. That is why anyone can create UUIDs independently, without a central registry, and still expect them not to clash.
How this generator makes them
The tool calls crypto.randomUUID(), the browser's built-in version 4 generator, which draws from a cryptographically secure random number generator. Browsers provide it only on secure (HTTPS) pages; where it is missing, the tool builds the same format from crypto.getRandomValues() bytes and sets the version and variant bits itself. It never uses Math.random().
UUID Versions: v4, v5 and v7
RFC 9562 defines several UUID versions. The version is the 13th hex digit, so you can read it straight off any UUID. This tool generates the three that matter for new systems:
| Version | Built from | Use it for |
|---|---|---|
| v4 | 122 random bits | General identifiers; the default |
| v7 | 48-bit Unix time in milliseconds + 74 random bits | Database keys that should sort by creation time |
| v5 | SHA-1 of a namespace UUID and a name | The same ID for the same input, every time |
Why v7 exists. RFC 9562 notes that random v4 values have poor database-index locality: each new key lands at a random place in the index. Version 7 puts the timestamp first, so new keys sort after older ones and stay close together. A batch generated here is returned in ascending order, as the RFC recommends for batches.
How v5 works. The namespace (DNS, URL, OID, X500 or your own UUID) and the name are hashed with SHA-1, and the first 128 bits become the UUID. There is nothing random in it: anyone with the same namespace and name gets the same UUID, so it is an identifier, never a secret. SHA-1 is used here for that mapping, not for security.
GUID vs UUID
There is no difference in format. RFC 9562 describes UUIDs as "also known as GUIDs (Globally Unique IDentifiers)"; GUID is the name Microsoft's platforms use for the same 128-bit identifier. A UUID from this page works wherever a GUID is expected.
The differences are in presentation: GUIDs are often written in uppercase and wrapped in braces, such as {36B8F84D-DF4E-4D49-B662-BCDE71A8764F}. Switch on "Uppercase" for that style; the braces are not part of the value itself.
What a UUID Is Not
Not guaranteed unique. Uniqueness is a matter of probability. With 122 random bits, the chance of a collision among a billion UUIDs is about 9 × 10⁻²⁰ - far below the chance of hardware faults - but it is not zero, so keep a unique constraint on columns that hold them.
Not a secret. UUIDs end up in URLs, logs and support tickets, and RFC 9562 warns that they must not be used as security capabilities. If knowing a value should grant access - a password reset link, a session, an API key - generate a dedicated secret with the API key generator.
Not encryption. A UUID does not hide or protect anything. It is a label, and the random bits carry no information.
UUID Generator FAQs
Can two UUIDs ever be the same?
In theory, yes - uniqueness is probabilistic, not guaranteed. A version 4 UUID has 122 random bits. If you generate one billion of them, the chance that any two match is about 9 × 10⁻²⁰. That is negligible for almost any system, but a database should still enforce uniqueness with a constraint rather than assume it.
Is a UUID a good password, token or API key?
No. RFC 9562 says implementations should not assume UUIDs are hard to guess and must not use them as security capabilities. Use the API key generator or the random string generator for secrets.
Is a UUID encrypted or does it contain my data?
Neither. A version 4 UUID is random bits plus a fixed version and variant field. It holds no information about you, your device or the time, and there is nothing to decrypt.
Which UUID version should I use?
Version 4 for most identifiers. Version 7 when the IDs become database keys and you want new rows to sort and insert in creation order. Version 5 when the same input must always map to the same UUID - for example an ID derived from a URL.
Does a version 7 UUID reveal when it was created?
Yes. Its first 48 bits are the creation time in milliseconds - the tool shows it under the result. RFC 9562 calls this a very small attack surface, but avoid v7 where the creation time of a record should stay private.
Why is the limit 1,000 UUIDs?
Generating is instant, but showing very long lists slows the page down. For more, generate several batches or create UUIDs in your own code with crypto.randomUUID().
Related guides
CSPRNG vs Math.random(): Why Secure Password Generators Use Web Crypto
