Generate cryptographically random RFC 4122 version-4 UUIDs in your browser, one at a time or in bulk, with options for uppercase output and hyphen removal. A NIL UUID shortcut is included for the cases where you need the all-zero identifier.
How to use it
- Choose how many identifiers you want.
- Toggle uppercase or hyphenless output if your target format demands it.
- Copy the results, or generate a fresh batch.
What version 4 actually guarantees
A UUID is 128 bits, conventionally written as 32 hexadecimal digits in five hyphen-separated groups. Version 4 fills those bits from a random source, except for six bits that are fixed: four identify the version, so the thirteenth hex digit is always 4, and two identify the variant, so the seventeenth digit is always 8, 9, a or b. That leaves 122 genuinely random bits. This generator draws them from crypto.getRandomValues, the browser cryptographically secure generator, rather than a statistical one.
The practical consequence of 122 random bits is that collisions can be ignored. You would need to mint on the order of a billion UUIDs per second for roughly a century before the probability of a single duplicate reached even one percent. That is why distributed systems can generate identifiers independently, with no coordination and no central sequence, and still safely merge the results.
Choosing a version, and where v4 hurts
Version 1 encodes a timestamp and the generating machine MAC address, which makes it sortable but leaks hardware identity and creation time. Version 4 leaks nothing but is deliberately unordered, and that randomness has a real cost: inserting random keys into a B-tree index scatters writes across the whole tree, fragmenting pages and hurting write throughput on large tables. That is the motivation behind the newer time-ordered version 7, which prefixes a millisecond timestamp so identifiers sort naturally while staying unguessable enough for most uses. If you are choosing a primary key today, weigh v4 opacity against v7 locality. Generation here happens entirely inside your browser, so no identifier is transmitted or recorded.
Frequently asked questions
Is a v4 UUID safe to use as a security token?
With a cryptographically secure source, 122 random bits is comfortably unguessable, so it resists brute force. The real risk is treating an identifier as an authorisation: anything reachable by knowing its UUID is protected only by that secrecy, and UUIDs routinely leak through logs, referrer headers and browser history. Use them as identifiers, and enforce access control separately.
Why is one digit always 4?
That nibble is the version field mandated by RFC 4122. The two most significant bits of the following group are the variant field, which is why the next digit is restricted to 8, 9, a or b. Together they consume six of the 128 bits.
Do you keep a record of generated UUIDs?
No. Nothing is stored or sent anywhere; the values exist only in your browser tab until you copy them.
Related tools: Password Generator, Hash Analyzer, Unix Timestamp Converter.