About UUID Validator
This checks whether a string is a well-formed UUID and tells you which version and variant it declares. Both matter: a value can be perfectly formatted and still be the wrong kind of identifier for what you are doing.
A canonical UUID is 32 hexadecimal digits in five hyphen-separated groups of 8-4-4-4-12. The version lives in the first hex digit of the third group, and the variant in the first digit of the fourth group - for RFC 4122 UUIDs that digit is 8, 9, a or b. Anything else means the value was not produced by a standard generator, which usually points at a hand-written test fixture or a truncated field.
Validation is deliberately stricter than most regexes found on the internet. A common one accepts any hex in the version position, so it happily passes a 'version 0' or 'version 9' UUID that no real generator emits. Knowing the version is also practically useful: it tells you whether the value sorts chronologically (v1, v6, v7), whether it is derived from a name (v3, v5), and whether it leaks a MAC address (v1).
The nil UUID (all zeros) and the max UUID (all Fs) are both valid special values, not errors. They show up as sentinels and as the result of an uninitialised field, so the tool identifies them rather than rejecting them.
Validation runs in your browser and nothing is transmitted.
How to use the UUID Validator
- Paste the UUID - with or without hyphens, in any case, and braces or a urn:uuid: prefix are tolerated.
- Read the verdict: whether it is well-formed, and which version and variant it declares.
- Check the version against what you expect. A v1 in user-facing data leaks a MAC address and a timestamp; a v4 will not sort chronologically.
- If it fails, compare the length first - 36 with hyphens, 32 without. A truncated or padded field is the most common cause.
Examples
-
Valid UUID v1
6ba7b810-9dad-11d1-80b4-00c04fd430c8 -
Valid UUID v4
550e8400-e29b-41d4-a716-446655440000
UUID Validator in code
The same operation this tool performs, in the languages you are most likely to need it.
// Strict: only versions 1-8 and RFC 4122 variants
const UUID_RE =
/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
const isUuid = (s) => UUID_RE.test(s);
const version = (s) => (isUuid(s) ? Number(s[14]) : null);
// The nil and max UUIDs are valid but fail the pattern above -
// special-case them if your input may contain sentinels.
const NIL = "00000000-0000-0000-0000-000000000000";
const MAX = "ffffffff-ffff-ffff-ffff-ffffffffffff";import uuid
def parse(value: str):
try:
u = uuid.UUID(value) # accepts hyphens, braces, urn:uuid:
except ValueError:
return None
return {"uuid": str(u), "version": u.version, "variant": u.variant}
# Careful: UUID() is lenient about formatting, so it accepts strings
# your database column might reject. Compare str(u) against the input
# if you need to enforce the canonical form.import java.util.UUID;
// UUID.fromString is famously lenient - it accepts "1-1-1-1-1".
// Round-trip to enforce the canonical 36-character form:
static boolean isCanonicalUuid(String s) {
try {
return UUID.fromString(s).toString().equalsIgnoreCase(s);
} catch (IllegalArgumentException e) {
return false;
}
}-- PostgreSQL: the uuid type validates on cast
SELECT '550e8400-e29b-41d4-a716-446655440000'::uuid;
-- Check a text column before migrating it to uuid
SELECT id FROM legacy
WHERE id !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$';
-- Extract the version digit
SELECT substring(id::text, 15, 1) AS version, count(*)
FROM things GROUP BY 1 ORDER BY 1;When you need this
- Confirming a value from a log, a URL or a support ticket is a real UUID before you go looking for it.
- Auditing which UUID versions a table actually contains before migrating a text column to a uuid type.
- Checking whether identifiers in your system are v1 and therefore leaking MAC addresses and timestamps.
- Debugging a validation error by seeing exactly which character position is wrong.
- Verifying that a generator you are testing produces the version it claims.
Common problems and what causes them
- A regex that accepts invalid versions
- The widely copied pattern uses [0-9a-f] in the version position, so it passes UUIDs claiming version 0 or 9 that no standard generator produces. Constrain that digit to [1-8] and the variant digit to [89ab].
- Java's UUID.fromString accepting malformed input
- It parses loosely and will accept "1-1-1-1-1", returning a padded UUID. If you need the canonical form, parse and compare the result back against the original string.
- Rejecting the nil UUID as invalid
- All-zeros is a legitimate UUID and a common sentinel. It also appears when a field was never populated, so treat it as a distinct case to handle rather than a parse failure.
- Case-sensitive comparison
- Uppercase and lowercase spellings are the same UUID. Normalise to lowercase before comparing, using one as a cache key, or storing in a text column with a unique index.
- Assuming a valid UUID is unique or trustworthy
- Validation only checks shape. A well-formed UUID may still be a duplicate, a value from a different tenant, or one an attacker supplied. Authorise the reference; do not treat unguessability as authorisation.
FAQ
- What makes a UUID invalid?
- Wrong length, non-hex characters, hyphens in the wrong positions, a version digit outside 1-8, or a variant digit outside 8-b. The two most common real-world causes are a truncated database column and a hand-written test fixture.
- How do I tell which version a UUID is?
- It is the first hex digit of the third group - character 15 of the canonical form. In 550e8400-e29b-41d4-a716-446655440000 that digit is 4, so it is a v4.
- Is the nil UUID valid?
- Yes. 00000000-0000-0000-0000-000000000000 is explicitly defined by the RFC, as is the all-Fs max UUID. Both are valid values used as sentinels, though the nil UUID often indicates a field that was never set.
- Are uppercase UUIDs valid?
- Yes. The RFC specifies lowercase for output but requires parsers to accept both, and several platforms - notably .NET and Windows tooling - emit uppercase. Normalise case before comparing.
- Does a valid UUID mean it exists in my database?
- No - validation is purely about format. A syntactically perfect UUID may reference nothing, or reference something the current user has no right to see, which is why the reference still needs an authorisation check.
- Does it verify signatures?
- No - structural validation only.