UUID generator
A fresh, cryptographically random version-4 UUID every time — produced by your own browser, never touched by a server.
Press Generate UUID and you get a brand-new version-4 UUID such as 3f2504e0-4f89-41d3-9a0c-0305e82c3301 — a 128-bit identifier drawn from cryptographically strong randomness. It is created by the browser's built-in crypto.randomUUID(), so every value is unique, unpredictable, and generated entirely on your device. Copy it into a database seed, a test fixture, a config file, an API request, or wherever you need a globally unique key you can hand out without coordinating with anyone.
Runs entirely in your browser. Your text is never uploaded — open DevTools, Network tab, and you will see zero requests while you use this tool.
How to use it
- Press Generate UUID. The tool calls crypto.randomUUID() and shows a fresh version-4 UUID.
- Press it again for another — each one is independent and vanishingly unlikely to ever repeat.
- Press Copy to grab the value, or Download .txt to save a batch you have generated.
- Paste it wherever you need a unique identifier — a primary key, a filename, an idempotency key, a correlation ID.
What a UUID is
A UUID — Universally Unique Identifier, also called a GUID (Globally Unique Identifier) in the Microsoft world — is a 128-bit number designed so that anyone, anywhere, can mint one at any time without a central registry and still be confident it collides with no other. That is the whole point: you do not ask a database for the next id, you do not lock a counter, you do not phone a coordinating service. You generate locally and move on, and the mathematics of a 128-bit space makes accidental duplication a non-event.
Because they need no coordination, UUIDs are the default identifier for distributed systems, offline-first apps, event streams and anything where two machines must create ids at the same instant without talking to each other. The trade-off is size and readability — 36 characters versus a short auto-increment integer — but the payoff is that ids can be created anywhere and merged without conflict.
The UUID format
A UUID is written as 32 hexadecimal digits grouped 8-4-4-4-12 and separated by hyphens: xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx. Those 32 hex digits encode the full 128 bits. The hyphens are pure convention for the eye. Two positions are not random: the digit marked M encodes the version (a literal 4 for a v4 UUID), and the top bits of the digit marked N encode the variant (so N is one of 8, 9, a or b). Everything else in a v4 UUID is random.
UUID versions: v1, v4, v7
The version digit tells you how the bits were produced. Version 1 mixes the current timestamp with the machine's MAC address. It sorts roughly by time, but it can leak the MAC address and the moment of creation, which is why it fell out of favour. Version 4 — what this tool produces — is 122 random bits. It carries no timestamp, no hardware fingerprint and no hidden meaning; it is just noise, which makes it the safe, universally supported default.
Version 7, standardised in RFC 9562 (2024), is the identifier the industry is moving to in 2025-2026. It puts a 48-bit Unix millisecond timestamp in the high bits and fills the rest with randomness. That gives the best of both worlds: still practically collision-free, still non-guessable in its random tail, but time-sortable. That matters for databases, because random v4 keys scatter inserts across a B-tree index and fragment it, while v7 keys append in order. Use v4 when you want an opaque, meaningless id; reach for v7 when the id is a database primary key.
When you need it
- Database primary keys. A UUID lets every service, shard or offline client create rows without asking a central sequence.
- API idempotency keys. Send a UUID with a request so the server can dedupe safely retried calls (payments, sign-ups) and never charge twice.
- Distributed and event systems. Correlation ids, trace ids and message ids that must be unique across many nodes with no coordination.
- Filenames and object keys. Uploaded assets and S3 keys that must not collide even when thousands are created per second.
- Test fixtures and seed data. Unique-by-construction values so tests do not fight over the same id.
crypto.randomUUID vs Math.random
This tool uses crypto.randomUUID(), the browser's native generator, and that choice is not cosmetic. It draws from the cryptographically secure random source and returns a correctly formatted RFC 4122 version-4 string with the version and variant bits already set for you.
The tempting shortcut, stringing together Math.random() calls, is the wrong tool. Math.random() is not cryptographic: its output is predictable from a small internal state, so ids can be guessed — fatal if a UUID gates access to something. Hand-rolled versions also routinely botch the fixed bits. If your platform lacks crypto.randomUUID, build the string from crypto.getRandomValues and set the version and variant bytes yourself — never from Math.random().
Doing it without this tool
Command line: uuidgen ships on macOS and most Linux boxes; on Linux cat /proc/sys/kernel/random/uuid reads one straight from the kernel. Python: python -c "import uuid; print(uuid.uuid4())". Node.js: node -e "console.log(crypto.randomUUID())".
In the database itself: PostgreSQL has gen_random_uuid(), MySQL 8 has UUID(), and SQL Server has NEWID(). Generating the id inside the DEFAULT clause is often cleaner than passing one from the app.
Privacy: generated in your browser
Every UUID here is produced by JavaScript on your own device through crypto.randomUUID(). No value is ever sent to a server, no value is stored, and none is logged. That matters because a UUID is sometimes used as a session token, an invite code or another semi-secret: it should be born on the machine that will use it, not round-tripped through someone else's backend.
Related tools
Frequently asked questions
Not guaranteed in the absolute sense — they are probabilistic — but the odds of a collision are so small they are ignored in practice. A version-4 UUID has 122 random bits. You would need to generate on the order of a billion per second for around 85 years before the chance of a single duplicate reached even 50%.
None that matters. GUID is Microsoft's name for the same 128-bit identifier; UUID is the RFC term. The format, the versions and the guarantees are identical.
Use v4 when you want an opaque identifier that reveals nothing. Use v7 when the id is a database primary key: its time-ordered prefix keeps B-tree indexes compact. v7 does expose roughly when the id was created. This tool generates v4, the universally supported default.
A v4 UUID from crypto.randomUUID() has 122 bits of cryptographic randomness, strong enough to act as an unguessable token. But it is not a password hash and not secret by nature — UUIDs are routinely logged and exposed in URLs. Never use a time-based v1 or v7 UUID as a secret.
That digit is the version marker. In a version-4 UUID the 13th hex digit is always the literal character 4, and the 17th is always one of 8, 9, a or b. Those six bits are fixed by the standard; the other 122 bits are random.
No coordination is needed and a clash is effectively impossible. That independence is the entire reason UUIDs exist: two machines, offline and unaware of each other, can each mint ids and later merge their data with no key conflict.
No. Generation happens entirely in your browser through the native crypto.randomUUID() call. Nothing is transmitted, stored or logged.