UUID generator and validator
Random v4 and time-ordered v7 UUIDs, up to 1,000 at once, and a validator and decoder for any UUID. Made in your browser from its cryptographic random source.
By using these tools you accept the Terms and the Privacy page.
How the UUID generator and decoder work
This UUID generator makes random version 4 and time-ordered version 7 UUIDs, one at a time or in batches, and its decoder explains what any UUID contains. It is for developers who need IDs for tests, records or database keys, and for anyone who wants to know what kind of UUID they are looking at and when it was made. Both follow RFC 9562, which replaced RFC 4122 in 2024.
How the generator makes them
A v4 UUID comes from the browser’s crypto.randomUUID. If a browser lacks that function, the page takes 16 bytes from crypto.getRandomValues and sets the version and variant bits itself.
For v7, the page keeps a single generator while it is open, so every v7 UUID sorts after the ones made before it, even across separate clicks. If the device clock steps back, the generator holds the last timestamp and keeps counting instead of going back in time. The result also shows the v7 timestamp in UTC, or the range a batch spans.
Formats, batches and downloads
- Uppercase, No hyphens and Braces can be combined. Without hyphens, a UUID is 32 hex digits in a row.
- A batch has Copy all and Download .txt, which saves
uuids-v4.txtoruuids-v7.txtwith one UUID per line. - A single UUID has a Decode it button that opens it in the decoder.
- Changing the version or a format option makes a new set, so copy what you need first.
- A count above 1,000 or below 1 is changed to the nearest limit.
What the decoder adds
The layout view marks the version digit, the variant digit and, in v1, v6 and v7 UUIDs, the digits that hold the timestamp. A creation time is given in UTC, in your local time and as an age, such as “3 years ago”. Other findings depend on the UUID:
- Node (v1 and v6): whether it is a random node ID, shown by the multicast bit, or may be the MAC address of the machine that made the UUID.
- Version 2 (DCE Security): the POSIX user or group ID and its local domain: person, group or organization.
- Not a standard UUID: the variant bits aren’t the RFC 9562 ones, so the version digit means nothing.
- Unknown version: a digit outside 1 to 8 may mean a random 128-bit value written like a UUID.
- Errors: a missing brace, a character that isn’t hex (with its position), the wrong number of digits, or hyphens outside the 8-4-4-4-12 groups.
Next steps
Copy canonical form gives the lowercase, hyphenated form of whatever you pasted, which is the form RFC 9562 asks for in output. To check the jti (JWT ID) claim of a token, copy it from the JWT decoder and paste it here: if it is a UUID, you see its version and, for a time-based one, when it was made.
Updated · Maintained by Liviu Tanase
Questions
Are the UUIDs made on a server?
No. They are generated in your browser with crypto.randomUUID and crypto.getRandomValues, the operating system’s cryptographic random source. Nothing is sent, nothing is put in the address bar, and the page keeps nothing after you leave.
v4 or v7: which should I use?
v4 is 122 random bits: use it when an ID must reveal nothing. v7 starts with a 48-bit Unix timestamp in milliseconds, so newer IDs sort after older ones. That keeps database indexes compact, because new rows land at the end of a B-tree, and RFC 9562 recommends v7 for database keys. The trade-off: anyone can read when a v7 UUID was made.
Can two UUIDs collide?
In practice, no. With 122 random bits you would need about 2.7 × 10^18 v4 UUIDs for a 50% chance of a single duplicate. A v7 UUID adds the millisecond to 73 bits of randomness, so a clash needs two UUIDs made in the same millisecond with the same random bits.
How do v7 UUIDs stay in order within one millisecond?
The 12 bits after the version digit are a counter (RFC 9562, section 6.2, method 1). In each new millisecond it starts at a random value below 2,048, and each further UUID in that millisecond adds one, so a batch of 1,000 stays in creation order. If it would pass 4,095, the timestamp moves on by a millisecond. The last 62 bits are random.
What does the decoder show?
The version and variant of any UUID; the creation time inside v1, v6 and v7 UUIDs, to 100 nanoseconds for v1 and v6; the clock sequence and node of v1 and v6; and whether it is the nil (all zeros) or max (all ones) UUID. Braces, urn:uuid: and missing hyphens are fine. A v4 has no time in it, and v3 and v5 are hashes of a name that can’t be read back.
Is a UUID the same as a GUID?
Yes. GUID is Microsoft’s name for the same 128-bit format. Windows tools often write GUIDs in upper case inside braces, such as {6F9619FF-8B86-D011-B42D-00C04FC964FF}, which the format options produce. Case doesn’t change the value, but RFC 9562 asks for lower case in output.
Can I use a UUID as a password or API key?
Better not. A v4 UUID is random, but UUIDs are made to be identifiers, so they get shown in URLs, emails and admin screens, and a v7 UUID is partly predictable because it holds a timestamp. For secrets, use a dedicated random value, such as a 32-character password from the password generator.
How do I check if a UUID is valid?
Paste it in the Decode a UUID tab. A valid UUID has 32 hex digits, in groups of 8-4-4-4-12 when it has hyphens; upper case, braces and urn:uuid: are fine. Otherwise the page names the problem: a character that isn’t hex (with its position), a missing brace, the wrong number of digits or misplaced hyphens. A well-formed UUID can still carry an unknown version or a non-standard variant, and the result says so. To check a token’s jti, copy it from the JWT decoder.
How do I generate a UUID in JavaScript?
crypto.randomUUID() returns a random v4 UUID in current browsers (on HTTPS pages only) and in Node.js; this page uses it too. There is no built-in v7 function yet, so this page builds v7 from Date.now() and crypto.getRandomValues, with the counter described above.