UUID Generator

How it works

A UUID (called a GUID in Microsoft environments) is 128 bits, written as 32 hexadecimal digits in groups of 8-4-4-4-12. RFC 9562 (May 2024, which replaces RFC 4122) fixes two small fields inside those bits: the version, in the first digit of the third group, and the variant, in the first digit of the fourth group. This generator makes two versions.

Version 4 is random. The tool calls crypto.randomUUID(), which provides 122 random bits; the other six are the version (0100) and variant (10) bits. Where that function is missing (browsers limit it to secure contexts), the same layout is built from 16 bytes of crypto.getRandomValues. The non-cryptographic Math.random generator is never used.

Version 7 is time-ordered. The layout is big-endian:

Inside one batch, the first UUID gets a random 12-bit counter in rand_a and every following one adds 1, so a batch is strictly increasing, also as text. If the counter would pass 0xFFF, the timestamp moves forward by one millisecond and the counter is seeded again, which means a very large batch can carry timestamps a few milliseconds ahead of your clock.

Ordering has limits. No state is kept between clicks. Two UUIDs made in the same millisecond by two separate calls may sort in either order, and a clock that goes backwards is not compensated. Read v7 order as "by millisecond", not as a creation sequence. The counter seed is random, so the 12 bits of rand_a are not a time fraction and carry no meaning on their own.

The checker

The second tool on the page reads the bits of any UUID you paste: hyphenated, 32 plain hex digits, in curly braces or with a urn:uuid: prefix, in any case. It reports the version, the variant (by the top bits of the first byte of the fourth group: 0xxx NCS, 10xx RFC 9562, 110x Microsoft, 111x reserved), whether the value is nil or max, and for version 7 the timestamp. It does not decode v1 or v6 timestamps, and it cannot prove how a value was produced.

Examples

The same v4 value in the four output formats: 919108f7-52d1-4320-9bac-f847db4148a8 (default), 919108F7-52D1-4320-9BAC-F847DB4148A8 (uppercase), 919108f752d143209bacf847db4148a8 (no hyphens) and {919108f7-52d1-4320-9bac-f847db4148a8} (braces).

How the v7 counter behaves (fixed bytes, from the tool's tests): with a counter seed of 00a, three UUIDs in one millisecond start 017f22e2-79b0-700a, 017f22e2-79b0-700b and 017f22e2-79b0-700c. With a seed of fff, the second UUID overflows the counter and starts 017f22e2-79b1-7001: the timestamp moved by 1 ms and the counter was seeded again.

Things to watch for

• A UUID is not a secret. Do not use one as a password, an API key or a reset link on its own. A v7 value also tells anyone, including this checker, when it was created to the millisecond.
• Uniqueness is a property of your system. A random 122-bit value is extremely unlikely to repeat, but only a unique constraint guarantees it. Do not rely on a generator alone.
• Use v7 for sorting, not as a clock. It sorts by millisecond, which is what RFC 9562 states as its goal; this page makes no performance claims about databases or indexes.
• Compare normalized values. Case, hyphens and braces vary between systems. Compare the lowercase hyphenated form, or the 128 bits, never the raw strings.
• The version digit is not proof. A string with a 4 in the right place may still not come from a random generator. The checker reads the bits and nothing else.
• Counts. One click gives 1 to 100 values. The checker accepts input up to 100 characters.
• Privacy. Values are generated and checked in your browser; nothing is sent or stored.