UUID Generator
Generate v4 and v7 UUIDs in bulk, with formatting options and one-click copy.
UUID Generator tool
What this tool does
It mints UUIDs in your browser using crypto.getRandomValues(), the same
cryptographically secure source your browser uses for TLS key material. Pick version 4 for
pure randomness, version 7 when you want identifiers that sort by creation time, or the nil
UUID when you need a well-known placeholder. Ask for one or ask for a thousand.
The formatting switches cover the shapes different ecosystems expect: bare lowercase for
PostgreSQL and JSON, uppercase inside braces for the Windows registry and COM, the 32-character
compact form for URLs, and the urn:uuid: prefix defined in RFC 9562 §4.
Common uses
- Seeding a database column or a fixture file with realistic primary keys.
- Creating a correlation ID to thread one request through several services' logs.
- Naming uploaded objects in S3 so two users cannot overwrite each other's file.
- Producing an idempotency key for a payment API that requires one per attempt.
- Filling a
uuidfield by hand while testing an endpoint in Postman or curl.
A short example
One value, shown in each supported format:
0190f6c2-4a51-7b19-8c3d-5e9a1b2c3d4e
0190F6C2-4A51-7B19-8C3D-5E9A1B2C3D4E
0190f6c24a517b198c3d5e9a1b2c3d4e
{0190f6c2-4a51-7b19-8c3d-5e9a1b2c3d4e}
urn:uuid:0190f6c2-4a51-7b19-8c3d-5e9a1b2c3d4e Why version 7 is usually the better database key
A v4 UUID is 122 random bits with four pinned to the version and two to the variant. Two values created a second apart have no relationship, so inserting them into a B-tree index writes to a random leaf page every time. The index stops fitting in cache, pages split constantly, and a table that was fast at a million rows is noticeably slower at fifty million — the fragmentation problem that made people reach for auto-increment integers.
Version 7 fixes the ordering without giving up global uniqueness. Its first 48 bits are the
Unix timestamp in milliseconds, big-endian, followed by the version nibble and 74 random
bits. Sorting v7 values as text or as bytes puts them in creation order, so inserts land at
the right-hand edge of the index the way a sequence would, and ORDER BY id
becomes a usable proxy for ORDER BY created_at.
The trade is that a v7 value leaks when it was created, to the millisecond. If an identifier is exposed publicly and that timing is sensitive — sign-up order, say — use v4 there.
Worth knowing
Uniqueness is probabilistic, not guaranteed. With 122 random bits you would need to generate
about 2.7 × 1018 v4 UUIDs before reaching a 50% chance of a single collision, which
is why nobody checks. What does break uniqueness is a weak random source: UUIDs built on
Math.random(), a bad server-side seed, or a container image that boots with the
same entropy pool have all caused real duplicate-key incidents. This tool never calls
Math.random().
Frequently asked questions
Is it safe to put a UUID in a public URL?
A v4 value encodes nothing about its origin — it is randomness and a version marker, revealing no machine, sequence position or row count. Versions 1 and 6 do reveal something: RFC 9562 §5.1 keeps a 48-bit node field that is conventionally the generating host’s MAC address. Whatever the version, an unguessable identifier is not an authorisation check — confirm the caller owns the record, or you have an IDOR bug.
How should a UUID be stored in a database column?
As 16 bytes rather than 36 characters. PostgreSQL has a native uuid type; MySQL has none, so use BINARY(16) with UUID_TO_BIN() and BIN_TO_UUID(), available since MySQL 8.0. A CHAR(36) column more than doubles the width of the key and of every secondary index that carries a copy of it, which on a hundred-million-row table is measured in gigabytes.
Did RFC 9562 replace RFC 4122?
Yes. RFC 9562 was published in May 2024 and obsoletes RFC 4122 entirely. It leaves versions 1 to 5 as they were and adds three: v6, which is v1 with the timestamp bits reordered so values sort; v7; and v8 for vendor-defined layouts. It also settles the case argument — generators are to emit lowercase hex, parsers are to accept either.