What a UUID is
A UUID (Universally Unique Identifier) is a 128-bit number used to label things without asking a central server for the next free number. It is written as 32 hexadecimal digits in five groups, 8-4-4-4-12, 36 characters in all. Two systems that have never met can create UUIDs and, for practical purposes, will never create the same one. UUIDs are used as database keys, file and object names, request and trace ids, session ids and message ids. Microsoft calls the same thing a GUID.
550e8400-e29b-41d4-a716-446655440000
^ ^
| +-- variant: first digit of this group is 8, 9, a or b
+------- version: 4 (random)
Versions of UUID
| Version | How it is made | Use it for |
|---|---|---|
| 1 | Timestamp (100 ns steps since 1582) plus a node id and a clock sequence | Older systems. Reveals time, and sorts badly as text. |
| 3 | MD5 hash of a namespace and a name | Stable ids from names. Prefer v5. |
| 4 | 122 random bits | The default. Ids with no meaning and no order. |
| 5 | SHA-1 hash of a namespace and a name | The same input always gives the same UUID. |
| 6 | Version 1 with the time fields reordered so that it sorts | Upgrading v1 data to a sortable form. |
| 7 | 48-bit Unix time in milliseconds plus random bits | Database keys that should sort by creation time. |
| 8 | Custom, defined by you | Special formats. |
If you are not sure, use v4. If the id will be a primary key in a large table, use v7, which keeps new rows together in the index. See the UUID v7 generator and the UUID v4 generator.
Options of this generator
- Version. v4, v7, v1, v6, v5 (with a namespace and a name), the Nil UUID (all zeros) and the Max UUID (all ones).
- Count. Up to 1,000 at once here. For more, use the bulk UUID generator, which makes up to 10,000 and lets you download them.
- Format. Standard, no hyphens, in braces, as a
urn:uuid:URN, or Base64URL (22 characters). - Style. Uppercase or lowercase, quotes, and a separator: new line, comma, space or a JSON array.
Version 5: the same name gives the same UUID
Choose version 5, pick a namespace (DNS, URL, OID, X.500, or your own UUID) and type a name. The result is a hash, so it never changes: the DNS namespace and the name python.org always give 886313e1-3b8a-5372-9b90-0c9aee199e5d. Use it to make a stable id from a URL, an email address or a file path.
Is it unique, and is it safe?
A v4 UUID has 122 random bits, about 5.3 × 1036 possible values. You would need to generate roughly 2.7 × 1018 of them before there is a 50% chance of one repeat. The random bits come from the browser's cryptographic generator, crypto.getRandomValues(), and not from Math.random(). Nothing is sent over the network and nothing is stored.
A UUID is an identifier, not a secret. Do not use one as the only protection for a private link or an account. For access tokens, use a purpose-made token of at least 128 random bits from your framework.
Generate a UUID in code
// JavaScript (browsers and Node.js 14.17+)
crypto.randomUUID();
# Python
import uuid; str(uuid.uuid4())
// PHP (no built-in function, so build it from random bytes)
$d = random_bytes(16);
$d[6] = chr(ord($d[6]) & 0x0f | 0x40);
$d[8] = chr(ord($d[8]) & 0x3f | 0x80);
vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($d), 4));
// Java
UUID.randomUUID().toString();
// C#
Guid.NewGuid().ToString();
// Go (github.com/google/uuid)
uuid.New().String()
# Ruby
SecureRandom.uuid
# Shell
uuidgen
Databases: PostgreSQL has gen_random_uuid(), MySQL has UUID() (a version 1 value) and SQL Server has NEWID(). For a GUID in .NET style, see the GUID generator.
Check a UUID
The checker at the bottom of the tool reads a UUID in any common form, tells you whether it is valid, and shows its version, variant and (for v1, v6 and v7) the time it was made. There is a page for it too: UUID validator. The background is in the guide What is a UUID?