UUID v4 Generator

How to use the UUID generator

A fresh UUID is generated when the page loads. Set How many to any number from 1 to 1,000 and press Generate for a new batch, one per line. Formatting options:

• Uppercase for systems that display GUIDs in capitals, such as many Microsoft tools. UUIDs are case-insensitive, so this does not change the value.
• No hyphens for a compact 32-character hex string.
• Braces for the registry-style format {xxxxxxxx-...} used in Windows and some C# code.

UUIDs are created with crypto.randomUUID(), the browser's built-in generator backed by a cryptographically secure random source. Older browsers fall back to crypto.getRandomValues() with the same version and variant bits. They are never fetched from a server, so nobody else has seen them.

What a version 4 UUID looks like

3f1c9a2e-7b4d-4e8a-9c21-5d0f6b7a8e13
              ^    ^
              |    variant: 8, 9, a or b
              version: always 4

A UUID is 128 bits written as 32 hexadecimal digits in groups of 8-4-4-4-12. In version 4, 122 of those bits are random. The 13th digit is always 4, and the 17th is always 8, 9, a or b. If you validate UUIDs with a regular expression, this is a safe pattern for v4:

^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

(use a case-insensitive match).

Are duplicates possible?

In theory yes, in practice no. With 122 random bits there are about 5.3 × 10³⁶ possible values. You would need to generate roughly 2.7 × 10¹⁸ UUIDs before the chance of even one collision reached 50%. A collision is far more likely to come from a bug, such as copying the same value twice, than from the random generator.

Typical uses

• Primary keys in databases, especially when records are created on several servers or offline clients.
• Test fixtures and seed data that need unique IDs.
• Idempotency keys and correlation IDs for API requests and logs.
• Unique file names for uploads.

Common mistakes

• Using UUIDs as secrets. v4 UUIDs are hard to guess, but they are designed as identifiers. For password reset links or API keys, use a dedicated random token generator with more entropy and treat the value as a secret.
• Storing them as text in large tables. A UUID needs 16 bytes in binary but 36 as a string. Databases such as PostgreSQL have a native uuid type; use it.
• Index fragmentation. Random v4 values are inserted all over a B-tree index. For very write-heavy tables, time-ordered UUID version 7 may perform better.
• "GUID" vs "UUID". They are the same thing; GUID is Microsoft's name for it.