Interactive generator
UUID generator (v4)
Cryptographically random UUID v4 strings.
-
🎮 How to Use
- Pick UUID version: v4 (random) or v7 (time-sortable).
- Set count. Click Generate. Copy bulk to clipboard.
About this tool
UUIDs (Universally Unique Identifiers): 128-bit random IDs. v4 is random; v7 is time-sortable (recommended for databases since 2024). Probability of collision: 1 in 2^122 - practically impossible.
About UUIDs
A UUID (Universally Unique Identifier) is a 128-bit value that any system can generate independently with effectively zero risk of colliding with one generated elsewhere. UUIDs sit at the core of distributed systems: database primary keys, request correlation IDs, session tokens, file handles, RPC trace IDs, and message IDs in event queues. The original spec is RFC 4122 (2005); the modern revision is RFC 9562 (2024) which formalises versions 6, 7, and 8.
Microsoft brands the same construct as GUID (Globally Unique Identifier). The format and algorithms are identical; only the spelling differs in legacy Windows APIs. This generator emits both v4 (random) and v7 (timestamp plus random), the two versions that account for more than 95 percent of new application traffic.
UUID versions explained
A UUID (Universally Unique Identifier, also called GUID by Microsoft) is a 128-bit number formatted as 36 characters: xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx. The M digit indicates the version, the N digit indicates the variant. The collision probability for v4 is negligible - generating 1 billion per second for 85 years has about a 50% chance of one collision.
| Version | Generated from | Sortable? | Best for |
|---|---|---|---|
| v1 | Timestamp + MAC address | Mostly | Legacy. Leaks the host MAC and creation time. |
| v3 | MD5 hash of a namespace + name | No | Deterministic IDs from inputs. |
| v4 | 128 random bits (122 effective) | No | Default choice. Best for most applications. |
| v5 | SHA-1 hash of a namespace + name | No | Same as v3 but better hash. |
| v6 | Reordered v1 (timestamp first) | Yes | Sortable by creation time. Replaces v1. |
| v7 | Unix epoch ms + random | Yes (lexically) | DB primary keys. Replaces v4 + ULID. |
Why v7 is the new default
UUID v4 is great for uniqueness but terrible for database performance. Random PKs cause B-tree page splits on every insert, which can slow large tables 2-10x compared to sequential IDs.
UUID v7 (RFC 9562, finalized 2024) prefixes the random portion with a Unix-milliseconds timestamp. This means new v7 UUIDs sort to the end of the index, restoring sequential-insert performance while keeping the universal-uniqueness guarantee.
Collision math
For v4 (122 random bits), the birthday-paradox 50% collision threshold is about 2.71 quintillion (2.71 x 10^18) UUIDs. To put that in perspective: generating one million UUIDs per second per device, on every smartphone on Earth, for 13 billion years, has roughly a 1 in 1,000 chance of a single collision.
Worked example: v7 anatomy
A typical v7 UUID looks like 018eed29-2c8d-7c4f-9e63-7a2d33b0e6e1. Break it apart:
- First 48 bits (12 hex chars):
018eed29 2c8dis the Unix milliseconds timestamp. That value decodes to 2024-04-19 around 14:00 UTC. - Next 4 bits:
7is the version marker (v7). - Next 12 bits:
c4fis the first slice of randomness (rand_a, 12 bits). - Next 2 bits:
10binary (encoded in the leading bits of9) is the variant marker (RFC 4122 family). - Final 62 bits (15.5 hex chars):
e63-7a2d33b0e6e1is rand_b, the bulk of the randomness.
Result: Total entropy 74 bits (12 in rand_a, 62 in rand_b). Two v7 UUIDs generated in the same millisecond differ only in the random portion; the probability of collision in a single millisecond is roughly 1 in 2^74 (around 18 sextillion to one).
Common pitfalls
- Using v1 in 2026. v1 leaks the host MAC address and creation time, which is a privacy and security regression. Migrate to v7.
- Using v4 as a database primary key on a large table. Random inserts fragment the B-tree index and slow inserts 2 to 10x. Use v7 or a sequential ID and store the UUID in a separate indexed column.
- Treating UUIDs as secrets. v4 is uniformly random but not authenticated. An attacker who knows the format cannot guess a specific v4 but can recognise the shape. Add an HMAC if the ID guards a resource.
- Parsing without validating version + variant. Many open-source libraries accept any 36-char hex string. Validate position 13 (version) and 17 (variant) before storing.
- Re-deriving v3 or v5 with the wrong namespace. v3/v5 are deterministic. Changing namespace UUID changes every derived ID, silently breaking foreign keys.
- Mixing case in URL slugs. Stick to lowercase. Some routers and DB column types are case-insensitive; some are not. Inconsistency causes lookup misses.
Related tools
Frequently asked questions
Should I use UUID v4 or v7 in 2026?
v7 for database primary keys: it sorts by creation time, plays well with B-tree indexes, and matches the role ULID played before v7 was standardised. v4 for everything else: session tokens, idempotency keys, request IDs, file names. Both have effectively zero collision risk.
Are UUIDs really collision-free?
Not in theory, but the math is reassuring. For v4 (122 random bits) the 50 percent collision threshold sits at about 2.7 quintillion UUIDs. Generating a million per second on every smartphone alive for 13 billion years gives a 1-in-1000 chance of one duplicate.
What is the difference between UUID and GUID?
None at the bits level. GUID is Microsoft's branding from Windows COM and .NET; UUID is the IETF spelling. Both follow RFC 4122 and the 2024 RFC 9562. Tools that emit one will be accepted by tools that expect the other.
Can I use a UUID as a session token or password?
As a session ID yes; v4 contains 122 random bits, comparable to a 20-character ASCII token. As a password no, because UUIDs are not hashed by the client and the dash-separated format leaks structure to log scrubbers. Wrap the UUID in an HMAC or signed cookie for any auth use.
How do I check whether a string is a valid UUID?
Use the regex ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-7][0-9a-fA-F]{3}-[89ab][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$. Positions 14 (version 1 to 7) and 19 (variant 8/9/a/b) carry the protocol metadata. Anything that matches is well-formed; whether it was generated by a trusted source is a separate question.
Sources
- Leach, Mealling and Salz (2005). RFC 4122: A Universally Unique Identifier (UUID) URN Namespace. IETF.
- Davis, Peabody and Leach (2024). RFC 9562: Universally Unique Identifiers (UUIDs). IETF.
- Buildkite Engineering (2023). Why we moved from UUIDv4 to UUIDv7 for primary keys. Blog post.
- Microsoft Docs. GUID structure (combaseapi.h). Windows COM reference.