What is a UUID?
A UUID (Universally Unique Identifier) is a 128-bit label formatted as 32 hexadecimal digits split into five groups by hyphens, for example 550e8400-e29b-41d4-a716-446655440000. Version 4 UUIDs are randomly generated, giving an astronomically low chance of two identical values ever being produced.
UUIDs are widely used as database primary keys, session tokens and unique identifiers in distributed systems where a central authority cannot assign IDs. This tool uses the browser's built-in crypto.randomUUID() which is cryptographically secure.
How do I generate a UUID v4?
To generate a UUID v4, fill 128 bits with cryptographically random values, then fix 6 specific bits to mark the version and variant so the value still matches the standard UUID format. Example format: 550e8400-e29b-41d4-a716-446655440000, where the "4" right after the second hyphen always marks version 4.
Steps to generate a version 4 UUID
- Generate 128 random bits (16 bytes) using a cryptographically secure random number generator.
- Set the 4 most significant bits of the 7th byte to 0100 in binary, which marks this as version 4 — this is why the first character of the third group is always "4".
- Set the 2 most significant bits of the 9th byte to 10 in binary, which marks the standard variant — this makes the first character of the fourth group always 8, 9, a, or b.
- Format the remaining bits as 32 hexadecimal digits.
- Insert hyphens to split the digits into groups of 8-4-4-4-12 characters, producing the final UUID string.
UUID v4 structure
xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx, where x is any random hex digit and y is one of 8, 9, a, or b
- Total length = 36 characters including 4 hyphens (32 hex digits + 4 hyphens)
- Version nibble = always "4" (marks version 4, meaning random generation)
- Variant nibble = always 8, 9, a, or b (marks the RFC-standard variant)
Example UUID v4 format (illustrative — each generation is random)
| Group | Length | Example segment |
|---|
| time_low | 8 hex digits | 550e8400 |
| time_mid | 4 hex digits | e29b |
| version + time_hi | 4 hex digits (starts with 4) | 41d4 |
| variant + clock_seq | 4 hex digits (starts with 8-b) | a716 |
| node | 12 hex digits | 446655440000 |
Frequently asked questions
How unlikely is it that two UUID v4 values collide?
A UUID v4 has 122 random bits (128 total minus 6 fixed version/variant bits), giving about 5.3 x 10^36 possible values. Generating a billion UUIDs per second for a billion years would still leave the chance of any collision negligibly small, which is why UUIDs are treated as effectively unique without central coordination.
Why does every UUID v4 have a 4 in the same position?
That character is not random — it is fixed by the standard to mark the UUID as version 4 (randomly generated), so software reading the ID can identify which UUID version and generation algorithm produced it, even without additional metadata.
Is a UUID the same as a GUID?
GUID (Globally Unique Identifier) is Microsoft's name for the same 128-bit identifier format standardized as UUID. The two terms describe the same underlying structure and are generally used interchangeably in practice, though some legacy Microsoft tooling has minor formatting differences.
Are UUIDs suitable as database primary keys?
UUID v4 works well when IDs must be generated independently across multiple servers without coordination, avoiding the bottleneck of a single auto-increment counter. The tradeoff is that random UUIDs are larger than integers and, unlike sequential IDs, can hurt index locality in some database engines under heavy insert load.
This tool generates version 4 (random) UUIDs using the browser's built-in crypto.randomUUID(), which is cryptographically secure; it does not generate other UUID versions such as v1 (timestamp-based) or v5 (name-based hash).
Sources: RFC 9562 - Universally Unique IDentifiers (UUIDs)
Privacy and safety
- Runs in your browser — Everything you type is calculated on your own device. Your inputs are never sent to a utilduck server.
- Encrypted connection — Pages are served over HTTPS, so nobody on the network can read what you load.
- Not shared with third parties — Your inputs are not passed to analytics or advertising services.
- Nothing is stored — Results are not saved to any server, and there is no account to create.
Last updated: 2026-08-17