GUID / UUID Generator
Generate a random version 4 UUID (GUID). Generation uses the Web Crypto API, so the values are cryptographically random and never leave your browser.
What a UUID is for
A UUID (Universally Unique Identifier) is a 128-bit value used as an identifier that can be generated anywhere, by anyone, without coordination, and still be safely assumed unique.
That last property is what makes UUIDs valuable. A database auto-increment counter requires a central authority to hand out the next number. UUIDs need no such coordination, which matters when:
- Multiple services create records independently and must merge them later
- An offline client generates records before syncing to a server
- IDs must not reveal how many records exist, unlike sequential numbers
- Merging databases must not produce primary key conflicts
The structure of a version 4 UUID
A UUID is written as 32 hexadecimal digits in five groups separated by
hyphens: xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
Two positions are not random:
- The 13th digit is always 4, marking the version.
- The 17th digit is one of
8,9,a, orb, encoding the variant.
That leaves 122 random bits out of 128. You can identify a v4 UUID by
inspection: look for the 4 at the start of the third group.
In f47ac10b-58cc-4372-a567-0e02b2c3d479,
the bold characters are the fixed version and variant markers.
UUID versions
| Version | Based on | Notes |
|---|---|---|
| v1 | Timestamp + MAC address | Sortable but leaks the generating machine's MAC address |
| v3 | MD5 of a namespace and name | Deterministic, same input gives same UUID |
| v4 | Random | Most widely used, no information leakage |
| v5 | SHA-1 of a namespace and name | Deterministic, preferred over v3 |
| v7 | Timestamp + random | Newer standard, time-sortable without leaking hardware details |
This generator produces v4, the sensible default for general use. Version 7 is worth knowing about: it keeps the randomness of v4 but prefixes a timestamp, so UUIDs sort chronologically, which addresses the database index problem described below.
How unlikely is a collision?
With 122 random bits there are about 5.3 × 1036 possible v4 UUIDs. To put that in perspective, you would need to generate roughly one billion UUIDs per second for about 85 years to reach a 50% chance of a single collision.
The practical caveat is randomness quality. A v4 UUID is only as unique as
the random number generator behind it. This page uses
crypto.randomUUID(), which draws from the operating system's
cryptographically secure source. Implementations built on
Math.random() do not offer the same guarantee, which is a real
problem in some older libraries.
Examples
| Example UUID | Note |
|---|---|
f47ac10b-58cc-4372-a567-0e02b2c3d479 | Standard v4 form |
9b74c9ff-9f8f-4a1e-8e9b-6d0a1f2c3b4d | Standard v4 form |
00000000-0000-0000-0000-000000000000 | The nil UUID, used to mean "no value" |
Practical considerations
UUIDs as database primary keys
Using random UUIDs as clustered primary keys has a genuine performance cost. Because values arrive in random order, each insert lands at an arbitrary point in the index, causing page splits and fragmentation. A sequential integer always appends at the end, which is far cheaper.
Common mitigations: store the UUID as a native 16-byte type rather than a 36-character string, keep a sequential integer as the clustered key with the UUID as a secondary unique column, or use UUID v7 so values remain time-ordered.
Formatting variants
The same UUID appears in several forms. Microsoft tooling often wraps it
in braces: {f47ac10b-58cc-4372-a567-0e02b2c3d479}. Some systems
strip the hyphens entirely. Uppercase and lowercase are both valid and refer
to the same value, though lowercase is the convention in RFC 4122.
Not a security token
A v4 UUID is unpredictable enough that guessing one is impractical, but it is designed for uniqueness rather than secrecy. Do not use one as a session token, password reset link, or API key on its own. Purpose-built token generation with expiry and revocation is the right mechanism there.
Frequently asked questions
Is a GUID the same as a UUID?
Yes. GUID is Microsoft's term, UUID is the general standard name, and both refer to the same 128-bit identifier format.
Can two generated GUIDs collide?
In practice, no. With 122 random bits, a collision requires generating billions per second for decades before it becomes likely.
How can I tell which version a UUID is?
Look at the first character of the third group. A 4 there
means version 4, a 1 means version 1, and so on.
Are UUIDs case-sensitive?
No. Uppercase and lowercase hexadecimal represent the same value. RFC 4122 recommends generating lowercase and accepting both.
Should I use a UUID as a database primary key?
It works, but consider the index fragmentation cost of random values. Store as a 16-byte native type where available, or use UUID v7 to keep values time-ordered.
Is this random data sent anywhere?
No. Generation happens entirely in your browser via
crypto.randomUUID(). Nothing is transmitted or logged.
Related tools
- Hash generator, for deterministic fingerprints rather than random IDs
- Number base converter, for working with the hexadecimal digits
- All developer tools