GeneratePass
SECURE CRYPTOGRAPHIC UUID GENERATOR

UUID v4 Generator

Bulk-generate cryptographically secure version 4 UUIDs instantly in your browser.

Generated Output
Specification

What is UUID v4?

A Universally Unique Identifier (UUID) version 4 is a 128-bit value generated randomly. It contains 122 bits of entropy and 6 bits of metadata defining the version and variant.

This tool uses the browser-native window.crypto.randomUUID() algorithm, which draws entropy directly from the OS-level Cryptographically Secure Pseudorandom Number Generator (CSPRNG). The probability of a duplicate is virtually zero, making them perfect for transaction IDs, primary keys, session tokens, and database indices.

Introduction

Every database needs a primary key, every API needs a request identifier, every distributed system needs a way to tell its objects apart without coordination. UUIDs solve this problem in 128 bits. The UUID Generator produces RFC 4122 compliant identifiers — the same standard used by PostgreSQL, MySQL, MongoDB, and virtually every major database engine — directly in your browser. No server round-trip, no sequential counters, no collision risk. Just cryptographically random identifiers that are globally unique across every device that will ever exist.

What This Tool Does

Why It Matters

Without unique identifiers, distributed systems break. Two servers generating sequential IDs will produce duplicates. Timestamps collide when requests arrive simultaneously. UUIDs eliminate coordination by encoding enough randomness that collisions are statistically impossible — the birthday problem says that at 2^64 random UUIDs, you have a 50% chance of one collision. For perspective, generating one billion UUIDs per second, it would take over 100 years to reach that threshold. This makes UUIDs the backbone of modern database design, microservice communication, and any system where objects must be uniquely identified without a central authority.

How It Works

Step-by-Step Examples

Example 1: Generate a batch of v4 random UUIDs for database records
1

Select UUID version v4 (random) — the most common variant for database primary keys

2

Set count to 5 to generate multiple UUIDs in one click

3

Click Generate to invoke crypto.getRandomValues() for each UUID

4

Copy the results directly into your SQL INSERT statements or ORM configuration

Resultf47ac10b-58cc-4372-a567-0e02b2c3d479, 9a3c2e1d-8b7f-4a5c-9d6e-1f2a3b4c5d6e, 7c9e6679-7425-40de-944b-e07fc1f90ae1, a1b2c3d4-e5f6-7890-abcd-ef1234567890, 123e4567-e89b-12d3-a456-426614174000
Example 2: Generate a v5 name-based UUID from a namespace and name
1

Select UUID version v5 (name-based SHA-1) for deterministic, reproducible UUIDs

2

Enter the namespace UUID — use the DNS namespace (6ba7b810-9dad-11d1-80b4-00c04fd430c8) for domain names

3

Enter the name string — e.g., 'example.com'

4

Click Generate to produce a deterministic UUID that is always the same for this namespace+name pair

Result9073926b-929f-31c2-abc9-fad77ae3e8eb — the same UUID will be generated every time for namespace 6ba7b810... and name 'example.com'

Code Examples

javascriptGenerate a v4 UUID using Web Crypto API
function generateUUIDv4() {
  const bytes = new Uint8Array(16);
  crypto.getRandomValues(bytes);

  // Set version (4) and variant (10xx) bits per RFC 4122
  bytes[6] = (bytes[6] & 0x0f) | 0x40; // Version 4
  bytes[8] = (bytes[8] & 0x3f) | 0x80; // Variant 1

  const hex = Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
  return `${hex.slice(0,8)}-${hex.slice(8,12)}-${hex.slice(12,16)}-${hex.slice(16,20)}-${hex.slice(20)}`;
}

// Generate 5 UUIDs
for (let i = 0; i < 5; i++) {
  console.log(generateUUIDv4());
}
javascriptGenerate a v5 UUID (deterministic from namespace + name)
async function generateUUIDv5(namespace, name) {
  const NS = '6ba7b810-9dad-11d1-80b4-00c04fd430c8'; // DNS namespace
  const nsBytes = hexToBytes(namespace || NS);
  const nameBytes = new TextEncoder().encode(name);

  const buffer = new Uint8Array(nsBytes.length + nameBytes.length);
  buffer.set(nsBytes);
  buffer.set(nameBytes, nsBytes.length);

  const hash = await crypto.subtle.digest('SHA-1', buffer);
  const bytes = new Uint8Array(hash).slice(0, 16);

  bytes[6] = (bytes[6] & 0x0f) | 0x50; // Version 5
  bytes[8] = (bytes[8] & 0x3f) | 0x80; // Variant 1

  const hex = Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
  return `${hex.slice(0,8)}-${hex.slice(8,12)}-${hex.slice(12,16)}-${hex.slice(16,20)}-${hex.slice(20)}`;
}

function hexToBytes(hex) {
  return Uint8Array.from(hex.replace(/-/g, ''), c => parseInt(c, 16));
}

// Deterministic UUID — same input always produces same output
const uuid = await generateUUIDv5(null, 'example.com');
console.log(uuid); // Always: 9073926b-929f-31c2-abc9-fad77ae3e8eb

UUID Versions and Their Use Cases

VersionMethodEntropyBest ForCollision Risk
v1Timestamp + MAC address60 bitsLegacy systems, time-ordered sequencesLow (but leaks MAC address)
v3MD5(namespace + name)128 bits (but MD5 is weak)Legacy name-based lookupsLow (but MD5 collision attacks exist)
v4Random (CSPRNG)122 bitsDatabase keys, API identifiers, general useNegligible (~1 in 2^122)
v5SHA-1(namespace + name)128 bits (140-bit security)Deterministic IDs from known inputsNegligible
v6Reordered timestamp122 bitsTime-ordered v4 replacementNegligible
v7Unix epoch + random122 bitsTime-ordered with full randomnessNegligible
v8Custom (RFC reserved)VariesVendor-specific implementationsVaries

UUID Format Breakdown

SectionLengthHex CharsContentExample
Time-low4 bytes8First 32 bits of timestampf47ac10b
Time-mid2 bytes4Middle 16 bits of timestamp58cc
Time-hi + version2 bytes4Top 16 bits + version (4)4372
Clock-seq + variant2 bytes4Variant (10xx) + sequencea567
Node6 bytes12Random or MAC-based node0e02b2c3d479

Benefits

  • RFC 4122 compliant output compatible with PostgreSQL, MySQL, MongoDB, and all major databases.
  • v4 UUIDs provide 122 bits of entropy — collision probability below 50% even after generating 2^61 UUIDs.
  • v5 UUIDs produce deterministic, reproducible identifiers from namespace+name inputs without randomness.
  • Fully client-side generation with zero network requests — your data never leaves the browser.

Use Cases

01

Database primary keys in distributed systems where sequential IDs would cause coordination overhead or expose record counts.

02

REST API resource identifiers that must be globally unique across microservices, regions, and deployment environments.

03

Content-addressable storage keys where the same content must always map to the same identifier.

04

Event sourcing and message queue correlation IDs for tracing requests across distributed systems.

Common Mistakes to Avoid

Using v1 UUIDs that embed MAC addresses, leaking hardware identifiers in publicly visible database columns.

Treating UUIDs as sortable — v4 UUIDs are random and unordered; use v7 or ULID if you need time-ordered identifiers.

Storing UUIDs as 36-character strings instead of 16-byte binary, wasting 125% storage on indexed columns.

Generating UUIDs on the server when the client could generate them, creating unnecessary round-trips and coordination.

Security Implications

UUIDv4 uses 122 bits of cryptographic randomness from the CSPRNG, making brute-force enumeration infeasible — even at 1 billion UUIDs per second, exhausting the search space would take longer than the age of the universe. However, v1 UUIDs embed the MAC address of the generating machine, potentially leaking hardware identity in logs, APIs, and database dumps. v3 and v5 UUIDs derived from predictable inputs (like domain names) are not secret — anyone who knows the namespace and name can reproduce the UUID. Never use UUIDs as authentication tokens or secrets; they are identifiers, not credentials.

Security Information

Frequently Asked Questions

Fundamentals

What is a UUID?

UUID (Universally Unique Identifier) is a 128-bit identifier standard designed to be unique across all devices and time. The most common version, UUID v4, generates purely random identifiers with a 122-bit random component, providing an astronomically low probability of collision. With 2^122 possible UUIDs, you could generate 1 trillion UUIDs per second for 85 years before having a 50% chance of a single collision.

UUIDs are formatted as 32 hexadecimal characters with hyphens separating groups: 550e8400-e29b-41d4-a716-446655440000. They are used globally in databases, distributed systems, APIs, and any application requiring unique identifiers without central coordination.

Technical Deep Dive

How UUID v4 Generation Works

UUID v4 generates a 128-bit random number and sets specific bits to identify the version (4) and variant (RFC 4122). The version bits (bits 48-51) are set to 0100, and the variant bits (bits 62-63) are set to 10. This ensures the UUID conforms to the standard while maintaining maximum randomness.

Entropy: UUID v4 provides 122 bits of randomness (128 bits minus 6 bits for version and variant). This gives a collision probability of approximately 1 in 2^122, which is virtually zero for any practical application.

Format: The standard UUID format is 8-4-4-4-12 hexadecimal characters. Our generator uses crypto.getRandomValues() for cryptographically secure random generation, ensuring each UUID is truly unpredictable.

Other Versions: UUID v1 uses timestamps and MAC addresses (privacy concerns). UUID v5 uses SHA-1 hashing of namespace and name. UUID v7 (newest) combines timestamps with randomness for time-sortable identifiers.

Practical Applications

Where UUIDs Are Used

Database Primary Keys: UUIDs serve as unique primary keys in distributed databases where sequential IDs would cause conflicts. They eliminate the need for centralized ID generation.

API Resource Identifiers: RESTful APIs use UUIDs to identify resources. They prevent enumeration attacks (where attackers guess IDs by incrementing numbers) and work across distributed systems.

Event Tracking: Analytics and event tracking systems use UUIDs to uniquely identify user sessions, page views, and interactions across distributed systems.

Decentralized Systems: In microservices architectures, UUIDs allow independent services to generate unique identifiers without coordinating with a central authority.

Security Pitfalls

UUID Security Mistakes

Using UUID v1: UUID v1 embeds the MAC address and timestamp, which can leak information about when and where the UUID was generated. For privacy-sensitive applications, use UUID v4 (random) or UUID v7 (time-sortable random).

Not Using Cryptographic Randomness: Generating UUIDs with Math.random() produces predictable UUIDs that can be guessed. Always use crypto.getRandomValues() for security applications.

Assuming Sequential UUIDs: Do not rely on UUID v4 being sortable by creation time. For time-sortable identifiers, use UUID v7 or ULID.

Using UUIDs as Secrets: UUIDs are public identifiers, not secrets. Never use them as API keys, passwords, or authentication tokens. Use dedicated secret token generators for security credentials.

Related Tools

Related Identifier Tools

Explore these unique identifier generation tools:

Frequently Asked Questions

How unique is a UUID v4?
UUID v4 provides 122 bits of randomness, giving a collision probability of approximately 1 in 5.3 x 10^36. You could generate 1 trillion UUIDs per second for 85 years before having a 50% chance of a single collision. For practical purposes, UUID v4 is effectively unique.
Can UUIDs be predicted?
UUID v4 generated with crypto.getRandomValues() cannot be predicted. However, UUID v1 can be predicted because it contains a timestamp and MAC address. Always use UUID v4 or later versions for security applications.
What is the difference between UUID v4 and v7?
UUID v4 is purely random. UUID v7 combines a timestamp with randomness, making it time-sortable while maintaining uniqueness. UUID v7 is newer and recommended for applications where chronological ordering matters, like database primary keys.
Should I use UUIDs for database primary keys?
UUIDs work well for distributed databases where sequential IDs would cause conflicts. However, they are larger than integer IDs and can impact index performance. Consider UUID v7 or ULID for better performance with time-based queries.
Are UUIDs URL-safe?
Standard UUIDs contain hyphens, which are URL-safe. However, some implementations remove hyphens or use different encodings. Our generator produces standard hyphenated UUIDs that work in URLs without encoding.