🆔 UUID / GUID v4 Generator

A UUID generator for bulk, cryptographically secure Version 4 UUIDs and GUIDs, with uppercase and hyphen-removal options. Runs in your browser.

✓ Free✓ No Signup Required✓ Browser-Based

Quantity to Generate

Uppercase CharactersRemove Hyphens

Generated UUID v4 Keys (Cryptographically Secure)

What UUID / GUID v4 Generator Does

A UUID is a 128-bit identifier designed to be unique without any central authority issuing it. That property is what makes it useful: two systems that have never communicated can each mint identifiers and safely merge their data later.

Version 4 UUIDs, the kind this tool generates, take their uniqueness purely from randomness — 122 of the 128 bits are random, with the remaining 6 fixed to mark the version and variant. There is no timestamp, no MAC address and no counter, so nothing about the originating machine leaks.

The format was originally specified in RFC 4122 and was superseded in May 2024 by RFC 9562, which retains versions 1 through 5 unchanged and adds versions 6, 7 and 8 for cases where time-ordering matters.

How to Use UUID / GUID v4 Generator

Select quantity of UUIDs to generate (1, 5, 10, 25, or 50)
Optionally toggle uppercase characters or remove hyphens
Click Copy All to copy all generated UUIDs at once

Formula Used by UUID / GUID v4 Generator

Collision probability (birthday bound)

p ≈ n² ÷ (2 × 2^122)

n: Number of UUIDs generated
2^122: The size of the v4 space — about 5.3 × 10^36, after the 6 fixed bits

Worked example

One billion (10^9) version 4 UUIDs.

n² = 10^18
2 × 2^122 ≈ 1.06 × 10^37
p ≈ 10^18 ÷ 1.06 × 10^37 ≈ 9.4 × 10^-20

Result: About 1 in 10^19. You would need to generate roughly 2.6 × 10^18 UUIDs before reaching a 50% chance of any collision.

UUID Versions

Versions 6–8 were added by RFC 9562 in 2024, largely to fix the database-index problems that random v4 values cause.

Version	Basis	Sortable by time?	Typical use
v1	Timestamp + MAC address	Partially	Legacy; leaks the host MAC address
v3	MD5 hash of a namespace + name	No	Deterministic IDs from a known name
v4	Random	No	General purpose — the common default
v5	SHA-1 hash of a namespace + name	No	Deterministic IDs; preferred over v3
v6	Reordered v1 timestamp	Yes	Drop-in replacement for v1 with better locality
v7	Unix epoch milliseconds + random	Yes	Database primary keys — the current recommendation
v8	Vendor defined	Depends	Custom schemes that still want the UUID format

Source: RFC 9562 — Universally Unique IDentifiers (UUIDs)

Anatomy of a Version 4 UUID

Example: f47ac10b-58cc-4372-a567-0e02b2c3d479 — 36 characters, 32 hex digits plus 4 hyphens.

Segment	Hex digits	Meaning
f47ac10b	8	Random
58cc	4	Random
4372	4	First digit is the version — always 4 here
a567	4	First digit is the variant — 8, 9, a or b for RFC 9562
0e02b2c3d479	12	Random

How to Read Your Result

Reading the version and variant

The 13th hex digit gives the version and the 17th gives the variant. In f47ac10b-58cc-4372-a567-…, the "4" at the start of the third group and the "a" at the start of the fourth mark it as a version 4, RFC-variant UUID. Any generator producing something else is not emitting a standard v4.

Why v4 hurts database indexes

Because v4 values are random, consecutive inserts land at random points in a B-tree index, fragmenting pages and destroying write locality. For a table with heavy insert volume this is measurable. Version 7 solves it by putting a millisecond timestamp in the high bits, so new rows append at the end of the index while remaining globally unique.

Unguessable is not the same as secret

122 bits of randomness makes a v4 UUID infeasible to guess, so exposing one in a URL does not invite enumeration. That is not the same as authorization — an unguessable URL is still readable by anyone who obtains it, through a referrer header, browser history or a shared link.

Limitations & Accuracy Notes

Uniqueness depends entirely on the quality of the random source. This tool uses the browser's crypto.getRandomValues(), which is a cryptographically secure generator; a v4 built on Math.random() is not, and can collide far sooner than the theoretical bound suggests.
A UUID occupies 16 bytes as binary, or 36 characters if stored as text. Storing them as VARCHAR(36) rather than a native UUID or BINARY(16) column roughly doubles the index size for no benefit.
Version 4 carries no information. If you need to know when a record was created, you still need a timestamp column — or a version 7 UUID.

Frequently Asked Questions

What is a UUID Version 4?

A UUID v4 is a 128-bit universally unique identifier generated using cryptographically secure pseudorandom numbers, with over 5.3 x 10^36 possible combinations.

What is the probability of two identical UUIDs being generated?

The odds of generating a duplicate UUID v4 collision are virtually zero (less than 1 in a billion even after generating 1 billion UUIDs per second for 100 years).

What is the difference between UUID v1 and v4?

v1 is generated from a timestamp plus the machine's network address, which makes it sortable but leaks when and partly where it was created. v4 is almost entirely random — 122 random bits — which leaks nothing and is the right default for identifiers that will be public.

Can two UUIDs collide?

In principle yes, in practice no. With 122 random bits you would need to generate on the order of a billion UUIDs per second for a century before the collision probability became meaningful. Collisions in the wild are almost always a faulty random source rather than bad luck.

Are these generated securely?

They use the browser's cryptographically secure random source rather than Math.random, and generation happens entirely on your device — nothing is requested from or sent to a server.

What is UUID v7 and should I use it?

v7 puts a Unix timestamp in the leading bits and fills the rest randomly, so IDs sort in creation order while staying unguessable. That is a real advantage as a database primary key, because random v4 keys scatter writes across a B-tree index. Support is newer, so check your library.

Should a UUID be stored as text or binary?

Storing as 16 bytes rather than a 36-character string saves space and speeds up comparisons, and most databases have a native type for it. The text form is for humans and APIs.

Is a UUID safe to expose in a URL?

A v4 UUID is unguessable, so exposing one does not reveal anything about your data volume the way a sequential integer does. It is still an identifier, not an authorization — a resource reachable by anyone holding the URL is only as private as the URL.

References & Further Reading

RFC 9562 — Universally Unique IDentifiers (UUIDs) — Current specification; obsoletes RFC 4122 and adds v6, v7 and v8

By OnlineToolHubs Team • September 2026