🆔 UUID Generator

A UUID is a 128-bit value written as 32 hexadecimal characters in five groups of 8-4-4-4-12, separated by hyphens. Two of those characters are reserved for metadata: the first character of the third group holds the version number, and the first character of the fourth group holds the variant, which for standard UUIDs is 8, 9, a or b.

Version 4 fills everything else with random data, leaving 122 random bits. Version 1 encodes a 60-bit timestamp counted in 100-nanosecond intervals since 15 October 1582, together with a clock sequence and a node field, which in a browser is generated randomly rather than taken from a network card. Version 7 places a 48-bit count of milliseconds since the Unix epoch of 1 January 1970 in the leading bits, then fills the remainder with random data.

The randomness comes from the Web Crypto API, which is designed to be unpredictable, and the tool uses the browser's built-in randomUUID function for version 4 where it is available.

Consider the identifier 3f2a8c41-9d7e-4b36-a1c5-7e0f2d9b4a68.

Count the groups: 8 characters, then 4, then 4, then 4, then 12, giving 32 hexadecimal characters plus 4 hyphens, so 36 characters in total. The third group begins 4b36, and that leading 4 is the version marker showing this is a random UUID. The fourth group begins a1c5, and the leading a is a valid variant character, confirming the standard layout.

Now the scale. With 122 random bits there are 2 to the power 122 possible version 4 UUIDs, which is about 5.3 times 10 to the power 36. If you generated a billion identifiers every second for a hundred years, you would create roughly 3.2 times 10 to the power 18 of them, an utterly negligible fraction of the space.

A version 7 identifier of the same length might read 018f3b2c-7a10-7c4d-b9e2-5f81a0c3d764, where the leading digits encode the generation time and sort in order.

Choose version 4 when you only need an opaque identifier and want no information leaked by the value itself. Choose version 7 when the identifier becomes a primary key in a database, because time-ordered values are inserted at the end of a B-tree index rather than scattered through it, which keeps the index compact and writes fast. Version 1 mainly exists for compatibility with older systems that expect it.

Be aware that version 1 and version 7 identifiers reveal roughly when they were created. That is helpful for debugging and unhelpful if the creation time is sensitive, for example when identifiers appear in public URLs and reveal sign-up dates.

Two cautions. A UUID is an identifier, not a secret: it is not a substitute for an access token, a password reset code or an API key, because those need to be tied to authentication rather than merely hard to guess. And store UUIDs in a dedicated column type where your database offers one, since a 16-byte binary form is far more efficient than a 36-character string.