UUID Generator

About UUID Generator

How to use the UUID Generator

1. Press Run to generate a UUID v4. Each press produces an independent value.
2. Copy it with the copy button - the canonical form is 36 characters, lowercase, hyphenated 8-4-4-4-12.
3. If you need many at once, use the Bulk UUID generator instead of pressing Run repeatedly.
4. If this is going to be a database primary key on a large table, read the note above about UUID v7 before committing to v4.

UUID Generator in code

The same operation this tool performs, in the languages you are most likely to need it.

// Browsers and Node 19+, no dependency needed
const id = crypto.randomUUID();

// Older environments: build it from secure random bytes
function uuidv4() {
  const b = crypto.getRandomValues(new Uint8Array(16));
  b[6] = (b[6] & 0x0f) | 0x40;   // version 4
  b[8] = (b[8] & 0x3f) | 0x80;   // variant (RFC 4122)
  const hex = [...b].map((x) => x.toString(16).padStart(2, "0")).join("");
  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-` +
         `${hex.slice(16, 20)}-${hex.slice(20)}`;
}

// Never do this - Math.random() is not a secure source
// and its output is predictable from previous values.

import uuid

print(uuid.uuid4())          # random v4
print(uuid.uuid4().hex)      # 32 chars, no hyphens
print(uuid.uuid4().bytes)    # 16 raw bytes

# uuid1() embeds the host MAC address and a timestamp - avoid it
# where the identifier is exposed to users.

import java.util.UUID;

UUID id = UUID.randomUUID();          // v4, uses SecureRandom
System.out.println(id);               // canonical 36-char form

// Note the two-long representation - this is the source of the
// byte-order confusion when storing UUIDs as binary:
long hi = id.getMostSignificantBits();
long lo = id.getLeastSignificantBits();

package main

import (
	"fmt"

	"github.com/google/uuid"
)

func main() {
	id := uuid.New()             // v4, panics if the RNG fails
	fmt.Println(id.String())

	// Use uuid.NewRandom() if you want the error instead of a panic.
}

// Guid.NewGuid() is a version 4 UUID
Guid id = Guid.NewGuid();
Console.WriteLine(id.ToString());        // "d" format, 36 chars

// .NET 9+ has a time-ordered version too:
// Guid v7 = Guid.CreateVersion7();

// Beware Guid.ToByteArray(): it uses little-endian order for the
// first three fields. Use ToByteArray(bigEndian: true) on .NET 8+
// when the bytes cross a system boundary.

-- PostgreSQL 13+
SELECT gen_random_uuid();

-- PostgreSQL 18+ adds time-ordered v7
-- SELECT uuidv7();

-- MySQL 8+ (returns a string; UUID() is v1, not v4)
SELECT UUID();
-- Store compactly and keep index locality:
SELECT UUID_TO_BIN(UUID(), 1);   -- the 1 swaps the time fields

-- SQL Server
SELECT NEWID();                  -- random, poor index locality
SELECT NEWSEQUENTIALID();        -- sequential, but predictable

# Linux (from the kernel)
cat /proc/sys/kernel/random/uuid

# macOS and Linux with util-linux
uuidgen | tr 'A-Z' 'a-z'

# Any machine with Python
python3 -c "import uuid; print(uuid.uuid4())"

When you need this

• Generating a primary key for a row you are about to insert, without a round trip to the database.
• Creating a correlation or request ID to trace one request across several services.
• Producing an idempotency key so a retried API call cannot double-charge or double-create.
• Naming an uploaded object in blob storage so two users' files can never collide.
• Filling a test fixture or seed file with realistic identifiers.

Common problems and what causes them

Using Math.random() or a language's default PRNG

A non-cryptographic generator has predictable internal state, so an attacker who sees a few identifiers can predict the next ones. That matters the moment a UUID is used as a password-reset token, an invitation link or an unguessable URL. Always use the crypto-backed API.

Using UUID v4 as a clustered primary key on a large table

Random keys scatter inserts across the whole index instead of appending at the end, causing page splits and poor cache locality. Symptoms are write throughput that degrades as the table grows. Use UUID v7, ULID, or a separate sequential clustered key with the UUID as a secondary unique column.

Storing a UUID as CHAR(36)

The canonical text form takes 36 bytes where the value is 16, and every index entry pays that cost. Use a native uuid type (PostgreSQL), BINARY(16) (MySQL, with UUID_TO_BIN), or uniqueidentifier (SQL Server).

Assuming UUIDs are case-sensitive or that hyphens are optional

The canonical form is lowercase with hyphens, but parsers accept uppercase and often accept the 32-character unhyphenated form. Two spellings of the same UUID are the same value, so normalise before using one as a cache key or comparing as a string.

Treating a UUID as secret

A v4 UUID is unguessable, which is not the same as secret. It will end up in logs, referrer headers, browser history and analytics. That is acceptable for a resource identifier and not acceptable for a long-lived bearer credential.

Expecting v4 UUIDs to sort chronologically

They carry no timestamp, so ORDER BY on a v4 column gives an arbitrary order. If you need creation order, store a timestamp column or use UUID v7.

FAQ

Are UUID v4 collisions actually possible?

Mathematically yes, practically no. With 122 random bits you would need around 2.7 x 10^18 UUIDs for a 50% chance of one collision - about 85,000 years at a million per second. A real duplicate almost always turns out to be a bug: a seeded or reused generator, a fixture copied twice, or a retry writing the same value.

Which UUID version should I use?

v4 for general-purpose random identifiers. v7 when the value is a database key and you want time-ordered inserts. v5 when you need a deterministic UUID derived from a name or URL. Avoid v1 in anything user-facing, because it embeds the generating machine's MAC address and a timestamp.

Is UUID v4 or v7 better for a primary key?

v7, in most cases. It keeps decentralised generation and unguessability in the random portion, while the leading millisecond timestamp means new rows append to the end of the index instead of scattering through it. The practical difference shows up as sustained write throughput on large tables.

How many characters is a UUID?

36 in canonical form (32 hex digits plus 4 hyphens), 32 without hyphens, 16 bytes as raw binary, and 22 characters if you Base64-encode it without padding.

Can I shorten a UUID?

You can re-encode the same 128 bits more compactly - Base64 gives 22 characters, Base58 gives 22 as well without ambiguous characters - and that is lossless. Truncating a UUID is different: dropping bits raises collision probability sharply, so a 64-bit truncation collides after roughly 5 billion values.

Is this generator safe to use for tokens?

The randomness is cryptographically secure, so a v4 UUID is unguessable. But 122 bits generated in a browser tab is best used for identifiers; for session tokens and API keys, generate them server-side and treat them as secrets that never appear in a URL.

How many can I generate?

Click Run each time you need a new UUID; each is independent.

Related reading

• How UUIDs work internally
• UUID v1, v4 and v7 explained
• Common UUID mistakes
• How to generate secure UUIDs
• Bulk UUID generator many at once
• ULID generator time-sortable alternative