Theme

Popular tools

UUID Generator

Generate a random UUID v4 or a time-ordered UUID v7 instantly, or up to 10,000 at once. It's an online GUID generator too: a new GUID is the same kind of 128-bit value. Paste any UUID to decode its version, creation time and every field.

RFC 9562 · crypto.getRandomValues · made and read in your browser, nothing is sent

The coloured digit is the version: the first digit of the third group in every UUID.

v4 · Random36 characters · 122 random bits
xxxxxxxx-xxxx-4xxx-Nxxx-xxxxxxxxxxxx
Anatomy · RFC 9562 §5.4128 bits · 32 hex digits · 36 characters
Hover or tap a field to read it

Made and read in your browser with crypto.getRandomValues; nothing is sent.

Format

What is a UUID, and what does UUID stand for?

UUID stands for Universally Unique Identifier: a 128-bit label that any computer can make on its own and still expect no other computer to make the same one. It is written as 32 hexadecimal digits in five groups, such as 919108f7-52d1-4320-9bac-f847db4148a8.

The format is defined by RFC 9562 (May 2024), which replaced RFC 4122 and added versions 6, 7 and 8. No central registry hands UUIDs out: uniqueness comes from randomness, from a timestamp, or from hashing a name, depending on the version.

Databases use them as primary keys, APIs as request and object IDs, operating systems for disks, partitions and software components. A GUID (Globally Unique Identifier) is Microsoft's name for the same thing.

One value, four sizesRFC 9562 §4

UniversallyUniqueIDentifier

  1. 128 bits
  2. 16 bytes
  3. 32 hex digits
  4. 36 characters with the hyphens919108f7-52d1-4320-9bac-f847db4148a8

GUIDMicrosoft's name for the same value

RFC 9562's version 4 example counted four ways. The text form adds four hyphens to the 32 hex digits: 36 characters.
UUID generator: a UUID v7 with its timestamp, version and random bits marked field by field, and a batch of v7 UUIDsUUID generator: a UUID v7 with its timestamp, version and random bits marked field by field, and a batch of v7 UUIDsPick a versionRandom v4, time-ordered v7, name-based v5 and the rest, each with its own colour.One clickCopy it, or make a new one; a batch of up to 10,000 goes out as text, CSV, JSON or SQL.Every fieldThe bits RFC 9562 defines for this version, with the time a v7 carries read out.Any formatBraces, no hyphens, upper case, Base64url, an integer or the .NET byte order.
A UUID v7 taken apart: the 48-bit timestamp, the version digit, the variant bits and the random part. Select a number to see what each part shows.

UUID format and length: 36 characters

A UUID is 128 bits, written as 32 hex digits and 4 hyphens in groups of 8, 4, 4, 4 and 12: 36 characters. The first digit of the third group is the version, and the first digit of the fourth group shows the variant: 8, 9, a or b for RFC 9562 UUIDs.

So 017f22e2-79b0-7cc3-98c4-dc0c0c07398f is version 7, RFC variant. Upper, lower and mixed case are all valid; most tools print lower case, macOS uuidgen upper case. Without hyphens it is 32 characters, in braces 38 (.NET's B format), as urn:uuid: 45, and in Base64url 22.

A UUID regex that checks the RFC form: ^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$ with the case-insensitive flag. It refuses the Nil and Max UUIDs, which are valid but special; the decoder above names them.

The text formRFC 9562 §4
017f22e28-79b04-7cc34-98c44-dc0c0c07398f12

32 hex digits + 4 hyphens = 36 characters

xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxxM version: 1–8N variant: 8, 9, a or b
Regex · case-insensitive^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$
The same 128 bits, written other ways
  • Standard017f22e2-79b0-7cc3-98c4-dc0c0c07398f36
  • No hyphens017f22e279b07cc398c4dc0c0c07398f32
  • Braces {…}{017f22e2-79b0-7cc3-98c4-dc0c0c07398f}38
  • urn:uuid:urn:uuid:017f22e2-79b0-7cc3-98c4-dc0c0c07398f45
  • Base64urlAX8i4nmwfMOYxNwMDAc5jw22
  • Base64AX8i4nmwfMOYxNwMDAc5jw==24
  • Base58BihbxwwQ4NZZpKRH9JDCz21
  • Base3201FWHE4YDGFK1SHH6W1G60EECF26
  • Integer1989357241971137676463954034883508623up to 39
  • Binary01 7f 22 e2 79 b0 7c c3 98 c4 dc 0c 0c 07 39 8f16 bytes
RFC 9562's own v7 example in each written form. The regex refuses the Nil and Max UUIDs on purpose: they have no version.

UUID versions explained: v1 to v8

The version says how a UUID was made: v4 from random bits, v7 from the time plus random bits, v1 and v6 from a timestamp and a node ID, v3 and v5 by hashing a name, and v8 in a layout of the maker's own.

Versions 2 and 0 aren't generated here: v2 (DCE Security) is reserved and RFC 9562 doesn't define its layout, and 0 isn't a version. The two special values have no version: the Nil UUID is all zeros and the Max UUID all ones (ffffffff-ffff-ffff-ffff-ffffffffffff, new in RFC 9562).

For new systems RFC 9562 recommends v7 over v1 and v6, and v5 over v3. v4 stays the plain choice when the value should say nothing about when it was made.

VersionIts 128 bitsMade fromSorts by time
v1Time + node · §5.1Time (100 ns) + clock sequence + nodeNo
v2DCE Security: reserved, no layout in RFC 9562Not generated: no layout defined–
v3Name · MD5 · §5.3MD5 of a namespace + a nameNo
v4Random · §5.4Random bitsNo
v5Name · SHA-1 · §5.5SHA-1 of a namespace + a nameNo
v6Sortable v1 · §5.6v1's fields, the time's high bits firstYes
v7Time-ordered · §5.7Unix time (ms) + random bitsYes
v8Custom · §5.8The maker's own layoutNo
Nil§5.9All zeros: “no value”–
Max§5.10All ones: a sentinel–
  • time
  • random
  • hash
  • clock sequence
  • node
  • version
  • variant
Each bar is one version's 128 bits as RFC 9562 lays them out, from its own test vectors. Only v6 and v7 put the time first, so only they sort by time as text.

UUID v4 vs v7: which should you use?

Use v7 for database keys and anything you sort or index: it starts with the creation time, so new rows land at the end of the index. Use v4 when the ID must not reveal when it was made: all 122 of its free bits are random.

Random v4 keys scatter every insert across a B-tree index, which splits pages and keeps more of the index hot in memory; v7 keys arrive in order like an auto-increment number, yet any server can make them without asking a database. A v7 keeps 74 random bits per millisecond, so two servers making one at the same moment still don't collide.

The trade-off: anyone who sees a v7 can read the millisecond it was made (paste one in the decoder above). If that matters, use v4, or keep v7 internal and show a different ID publicly.

12 inserts into a B-tree index8 leaf pages · 16 keys each
v4 keys land anywhere7 of 8 pages touched · 3 page splits
Pages by first byte
00–1fsplit
20–3f
40–5f
60–7f
80–9f
a0–bf
c0–dfsplit
e0–ffsplit
c100eb4b-4f3f-4b29-ad77-da7cd9d1eda592c97333-2db8-4fc2-b5b6-cedd8c7abede
v7 keys land at the end1 of 8 pages touched · 0 page splits
Pages by the day the keys were made
Oct 17
Oct 18
Oct 19
Oct 20
Oct 21
Oct 22
Oct 23
Oct 24
01a16d3e-e1c0-70f6-99ec-6d454991b2fa01a16d3e-e1c0-70f6-99ec-6d45c2f6b35b
  • already in the index
  • free
  • new v4
  • new v7
  • page split: half its keys move to a new page
A model, not a benchmark: leaf pages of 16 keys. Random keys find older pages nearly full and split them; v7's first bytes are the time, so all twelve go to the newest page, which still has room.

GUID vs UUID: is there a difference?

A GUID and a UUID are the same 128-bit value in the same text form; GUID is Microsoft's name for it. Guid.NewGuid() in .NET makes a random version 4 UUID, and .NET 9's Guid.CreateVersion7() a version 7.

The difference is in memory. Microsoft's GUID structure stores its first three groups as little-endian integers, so .NET's ToByteArray() gives the first 8 bytes in a different order than RFC 9562's network byte order: 919108f7-52d1-… becomes the bytes f7 08 91 91 d1 52 …. The text is the same; raw bytes moved between systems need converting. The decoder shows both orders.

SQL Server's uniqueidentifier also sorts by its last six bytes first, so v7 values don't stay in time order there; NEWSEQUENTIALID() makes values that do, though they can start lower again after a restart and are easy to guess. Old COM GUIDs can carry Microsoft's own variant bits instead of RFC 9562's; the decoder names that variant.

One GUID, three byte orders16 bytes
919108f7-52d1-4320-9bac-f847db4148a8
RFC 9562 network order
.NET Guid.ToByteArray()
SQL Server uniqueidentifier orderThe last six bytes decide the order
  • Data1 · 4 bytes, reversed
  • Data2 · reversed
  • Data3 · reversed
  • Data4 · as is
The same text in memory: .NET stores the first three groups little-endian, and SQL Server sorts by the last six bytes first, so time-ordered v7 keys don't stay in order there.

How to generate a UUID in code

Most languages make a v4 UUID in one line, and many now make v7 too: Python 3.14's uuid.uuid7(), .NET 9's Guid.CreateVersion7(), Java 26's UUID.ofEpochMillis(), Go 1.27's uuid.NewV7(), Node.js 26.1's crypto.randomUUIDv7() and PostgreSQL 18's uuidv7(). Browsers still have only crypto.randomUUID(), a v4.

Pick your language for the one-liner. Not every v7 keeps UUIDs made in the same millisecond in order: Python's and Go's do, .NET's and Node's don't promise it. And MySQL's UUID() returns a version 1 UUID, which on Linux and Windows carries the server's real MAC address.

Built-in UUID functions, per language

Python
import uuid

uuid.uuid4()   # v4
uuid.uuid7()   # v7, Python 3.14+
uuid.uuid5(uuid.NAMESPACE_DNS, "www.example.com")  # v5

uuid7() keeps a 42-bit counter, so UUIDs from one millisecond stay in order.

Versions as each language's own documentation lists them; the marks are the projects' own logos.

Can two UUIDs be the same?

In theory yes, in practice no: a v4 UUID has 122 random bits, about 5.3 × 10³⁶ values. You would need to make about 103 trillion of them for a one-in-a-billion chance that any two match, and about 2.7 quintillion for even odds.

That is the birthday bound: with n random values out of N, the chance of a repeat is about 1 − e^(−n(n−1)/2N). Making a billion UUIDs a second, a 50% chance would take about 86 years. Real duplicates come from broken generators: a non-random seed, a virtual machine cloned with its random state, or IDs copied by hand.

For v7, only UUIDs made in the same millisecond can match, and 74 random bits tell those apart. The generator here also keeps a batch in order inside one millisecond (RFC 9562 §6.2), so 10,000 at once are unique and sorted.

The birthday boundour arithmetic
Chance that any two are the same1 in 1.1 × 1019p ≈ 9.4 × 10−20

At a billion a second, making that many takes 1 second.

p ≈ 1 − e^(−n(n−1)/2N), with N = 2¹²² for v4 and 2⁷⁴ per millisecond for v7. RFC 9562 gives no collision figures: these are ours, from the same function the page uses.

UUID decoder: how to read a UUID's timestamp

Paste a UUID into Decode & validate, the UUID decoder and validator above: it reads the version and variant from two fixed places, then the fields that version defines. A v7 gives the millisecond it was made, a v1 or v6 the time to 100 nanoseconds plus a clock sequence and a node ID.

A v1 or v6 node with the multicast bit clear may be the network card's real MAC address; look its maker up in the MAC address lookup. Generators that respect privacy set that bit and use a random node, as this one does.

The time is what the generator wrote, not proof of when the UUID was made. v4 holds no time, only random bits, and v3, v5 and v8 hold hashes: there's nothing to read back, and a hash can't be reversed to the name. Paste a list to check up to 1,000 at once: invalid lines, duplicates and whether time-based UUIDs are in order.

Two ways to write the same momentRFC 9562 · Appendix A
017f22e2-79b0-7cc3-98c4-dc0c0c07398f
  1. unix_ts_ms0x017f22e279b0
  2. ms since 19701 645 557 742 000
  3. UTC2022-02-22T19:22:22.000Z
c232ab00-9414-11ec-b3c8-9f6bdeced846
  1. time_high · time_mid · time_low1ec 9414 c232ab00
  2. 100-ns steps since 1582-10-15138 648 505 420 000 000
  3. UTC2022-02-22T19:22:22.0000000Z

The same moment: RFC 9562's examples were made together.

A v7 starts with the milliseconds since 1970. A v1 stores the low part of its time first, so the decoder puts the three parts back in order before counting from 15 October 1582.

Name-based UUIDs: v5 and v3

A v5 UUID is the SHA-1 hash of a namespace UUID plus a name, cut to 128 bits with the version and variant set; v3 does the same with MD5. The same namespace and name always give the same UUID, on any computer: pick v5 above to use this page as a UUID v5 generator.

RFC 9562 defines four namespaces: DNS for domain names, URL, OID and X.500. So www.example.com in the DNS namespace is always 2ed6657d-e927-568b-95e1-2665a8aea6a2 as v5. Use name-based UUIDs to give a stable ID to something that already has a unique name, without storing a mapping.

Choose v5 over v3: MD5 is weaker, and RFC 9562 recommends v5. Neither is a way to hide the name: anyone who can guess it can compute the same UUID. The v8 option here uses SHA-256 the same way, as in the RFC's own v8 example.

Namespace + name → v5RFC 9562 §5.5
  1. Namespace6ba7b810-9dad-11d1-80b4-00c04fd430c8DNS · 16 bytes
  2. Name"www.example.com"UTF-8 · 15 bytes
  3. SHA-1 digest, 160 bits2ed6657de927468b55e12665a8aea6a22dee3e35the first 128 bits are kept
  4. The UUID2ed6657d-e927-568b-95e1-2665a8aea6a2version digit 4 → 5 · variant digit 5 → 9
  • DNS6ba7b810…
  • URL6ba7b811…
  • OID6ba7b812…
  • X.5006ba7b814…
RFC 9562's own v5 example: www.example.com in the DNS namespace. Any computer that hashes the same namespace and name gets the same UUID.

ULID vs UUID v7 (and other IDs)

A ULID and a UUID v7 both start with a 48-bit millisecond timestamp and sort by time. The difference: a ULID uses all its other 80 bits for randomness and is written as 26 Base32 characters, while a v7 spends 6 bits on its version and variant and fits every UUID column and library.

If your database, ORM or API already speaks UUID, v7 gives you time order without a new type. NanoID and similar short IDs are random strings of a chosen length, with no time and no standard layout. Any UUID can also be written shorter: 22 characters in Base64url, at most 22 in Base58.

Three IDs, 128 bits eachto scale
UUID v7time, then random
36 characterssorts by time
ULIDtime, then random
26 characterssorts by time
UUID v4random only
36 charactersno order
  • milliseconds since 1970
  • random
  • version and variant
UUID v7 and ULID share the 48-bit millisecond clock; v7 gives 6 bits to its version and variant, ULID uses all 80 for randomness. A v4 is random only; in Base64url any UUID is 22 characters.

Are UUIDs secure to use as tokens?

No. RFC 9562 says not to assume UUIDs are hard to guess, and never to use one as a security capability: an ID whose possession grants access, such as a password reset link or an API key.

A v4 from a good generator is random, but a v1, v6 or v7 reveals its creation time and a v3 or v5 can be recomputed from its name. For secrets, use a token made for it, such as 256 random bits from a cryptographic generator, and check permission on every request. UUIDs are fine as public IDs when access is checked separately.

IDWhat anyone who sees it can learnAs a secret
v1, v6When it was made, and maybe the network card's MAC addressNo
v7The millisecond it was madeNo
v5, v3Nothing new, but a guessed name gives the same UUIDNo
v4Nothing, from a sound generatorNo
256-bit tokenNothing: made for secretsYes
RFC 9562 says not to assume UUIDs are hard to guess or to use them as security capabilities. Use a token from a cryptographic generator for secrets and check access on every request.

UUID generator: questions and answers

How do I generate a UUID?

Open this page: a random UUID v4 is ready to copy, and New UUID makes another. Pick v7 to use it as a UUID v7 generator, set a count for up to 10,000 at once, and choose a format such as braces or Base64url. In code, crypto.randomUUID() in JavaScript, uuid.uuid4() in Python and Guid.NewGuid() in C# each make a v4 in one line.

What does UUID stand for?

Universally Unique Identifier. It is a 128-bit value, written as 36 characters such as 919108f7-52d1-4320-9bac-f847db4148a8, that computers make independently with no central registry and still expect to be unique. RFC 9562 defines it. Microsoft calls the same value a GUID, a Globally Unique Identifier.

Is a GUID the same as a UUID?

Yes, for practical purposes: the same 128 bits and the same text form, and Guid.NewGuid() makes a standard version 4 UUID. Two details differ. .NET stores the first three groups little-endian, so raw byte arrays come out in a different order, and SQL Server sorts uniqueidentifier values by the last group first. To generate a GUID, use this page as a random GUID generator: the text you copy works in both worlds.

Which UUID version should I use?

Version 7 for database keys and anything sorted, because it starts with the creation time and keeps indexes compact. Version 4 when the ID shouldn't reveal when it was made. Version 5 when the same name must always map to the same ID. Avoid v1 for new work: RFC 9562 recommends v7 instead, and a v1 can carry a real MAC address.

Can two UUIDs ever be the same?

Only by an astronomically small chance when the generator is sound. A v4 has 122 random bits, so about 103 trillion UUIDs give a one-in-a-billion chance of a single repeat, and a 50% chance needs about 2.7 quintillion. Real-world duplicates come from faulty generators, cloned virtual machines or copied data, not from the maths.

Can you decode a UUID?

Partly. Every UUID shows its version and variant. A v7 also reveals the millisecond it was made, and a v1 or v6 the time to 100 nanoseconds, a clock sequence and a node ID, sometimes a real MAC address. A v4 holds only random bits, and v3 and v5 hold hashes that can't be turned back into the name. Paste one under Decode & validate.

How long is a UUID?

128 bits, or 16 bytes. As text it is 36 characters: 32 hexadecimal digits and 4 hyphens in groups of 8-4-4-4-12. Without hyphens it is 32 characters, in braces 38, with the urn:uuid: prefix 45, in Base64url 22 and as a decimal integer up to 39 digits. Store it as a native UUID type or 16 bytes rather than text when you can.

What is an empty GUID or Nil UUID?

The value with all 128 bits zero: 00000000-0000-0000-0000-000000000000. RFC 9562 calls it the Nil UUID, and .NET's Guid.Empty is the same value, often used to mean no ID set. RFC 9562 also defines the Max UUID, all ones, ffffffff-ffff-ffff-ffff-ffffffffffff, as a sentinel (.NET 9: Guid.AllBitsSet). Neither is random, so never use them as real IDs.

Is UUID v7 sortable?

Yes. Its first 48 bits are the Unix time in milliseconds, so sorting v7 UUIDs as text or as bytes sorts them by creation time to the millisecond. Within one millisecond, order depends on the generator: this one keeps a batch strictly increasing, as RFC 9562 section 6.2 describes. SQL Server's uniqueidentifier is the exception: it compares the last group first.

Is it safe to use a UUID as a password or access token?

No. RFC 9562 warns not to assume UUIDs are hard to guess or to use them as security capabilities. Time-based versions reveal when they were made and name-based ones can be recomputed. Use a random token from a cryptographic generator for secrets, and treat UUIDs as public IDs with access checked separately. For passwords, use the password generator.

Are the UUIDs made here sent anywhere?

No. They are made in your browser with crypto.getRandomValues, its cryptographically secure random generator, and pasted UUIDs are decoded on your device. Nothing you generate or paste is sent to us or anyone else. A share link carries only what you chose: the version, count and format, the name for v5, or the UUIDs you pasted into the decoder, so share it as you would those.

Missing something?Suggest a feature or a new tool

Related tools