Generate real version 4 or version 7 UUIDs in your browser -- version and variant bits set properly, drawn from the Web Crypto API rather than Math.random(). Choose hyphens, case and braces, and take up to 100 at a time.
A UUID -- Universally Unique Identifier, also called a GUID -- is a 128-bit number written as 32 hexadecimal digits in five hyphenated groups, like 3f2504e0-4f89-41d3-9a0c-0305e82c3301. Its purpose is to let separate systems mint identifiers that will not collide without ever talking to each other: no central counter, no coordination, no round trip to a database to ask what the next number is. Version 4, the common one, is almost entirely random -- 122 of the 128 bits, which is enough that you could generate a billion a second for a century and still be at about a one in two chance of a single duplicate. The other six bits are not random and must not be: four record the version and two the variant, and a parser reads them to work out what it is holding. That is what separates a UUID from 32 random hex digits, which look identical and fail validation. Version 7 is newer and puts a millisecond timestamp in the leading 48 bits, so v7s sort by creation time -- which matters a great deal to any database using one as a primary key.
This generator makes real, spec-conformant UUIDs in your browser -- version 4 for pure randomness and version 7 for time-ordered ones -- with the version and variant bits set properly rather than left to chance. Choose hyphens, case and braces, and draw up to 100 at a time. The random bits come from the Web Crypto API's cryptographically secure source, not Math.random(), which is what makes the uniqueness guarantee real rather than approximate.
Every result here is drawn using crypto.getRandomValues() -- the Web Crypto API's cryptographically secure randomness -- instead of Math.random(), so it's genuinely unpredictable, not just statistically random. Learn more.
Primary keys and record ids, correlation and trace ids for distributed logging, idempotency keys on an API, filenames for uploads that must not collide, test fixtures and seed data, device and session identifiers, and anywhere you need an identifier now without asking a server for one.
Sixteen bytes are drawn from crypto.getRandomValues, then six specific bits are overwritten: the version nibble in byte 6 and the two variant bits in byte 8. For version 7 the first six bytes are replaced with the current Unix time in milliseconds before that stamping, which is what makes a v7 sort chronologically as plain text. Nothing is sent anywhere -- the whole thing happens locally.
For practical purposes, yes. A version 4 UUID carries 122 random bits, so the chance of two colliding is comparable to the chance of picking the same atom twice out of a large asteroid. The important caveat is the source of the randomness: this uses the Web Crypto API, the same source used for encryption keys, rather than Math.random(), whose output is predictable from enough observed values.
A v4 is random throughout. A v7 begins with a 48-bit millisecond timestamp, so a list of v7s sorts into the order they were created. That is worth having if the UUID is a database primary key: random keys scatter inserts across the whole index, while time-ordered keys append to the end of it, which is markedly faster and fragments the index far less.
Yes, in practice. GUID is Microsoft's name for the same 128-bit identifier, and the two are interchangeable. The one habit that differs is presentation: Microsoft tooling often writes them in uppercase and wrapped in braces, which is why both are options here.
A version 4 UUID has 122 bits of entropy, which is more than enough to be unguessable -- but a version 7 does not, because a third of it is a timestamp anyone can predict. And UUIDs are routinely logged, put in URLs and printed in error messages, so treating one as a secret is a habit worth avoiding entirely. Use the password generator instead.
No, and this is the usual bug in a hand-rolled implementation. Six of the bits are reserved: four say which version this is and two say which variant. A parser or a validator reads them, so a string of purely random hex will be rejected as malformed even though it is the right length and the right alphabet.
Wheel of Names · Spin the Bottle · Ladder Game · Card Draw · Coinflip · Plinko