Generate version-4 UUIDs
Produce random UUIDs for database keys, test fixtures, correlation IDs and idempotency keys. Every value comes from the browser cryptographic random source, not Math.random, and nothing is transmitted or logged. Choose how many you need and how they should be formatted.
How to use the UUID Generator
- Set how many UUIDs you need (up to 500).
- Choose the formatting: case, hyphens, braces or URN prefix.
- Click Generate.
- Copy the list or download it as a text file.
What a UUID looks like
A UUID is a 128-bit value written as 32 hexadecimal digits in five hyphen-separated groups of 8-4-4-4-12, for example f47ac10b-58cc-4372-a567-0e02b2c3d479. Two positions are not random: the first digit of the third group is the version (a 4 here) and the first digit of the fourth group encodes the variant, so it is always 8, 9, a or b. That leaves 122 random bits.
How likely is a collision?
With 122 random bits you would need to generate roughly 2.7 × 1018 UUIDs before reaching a 50% chance that any two matched — about a billion a second for 85 years. In practice the risk that matters is a weak random source, not the maths, which is why this tool uses crypto.randomUUID() (falling back to crypto.getRandomValues), never Math.random().
Version 4 and the alternatives
RFC 9562, which replaced RFC 4122 in 2024, defines eight versions. Version 4 is pure random and the right default when you simply need a unique identifier. Version 7 is worth knowing about: it puts a 48-bit Unix millisecond timestamp at the front, so values sort by creation time. That matters for database primary keys, because a random v4 inserted into a B-tree index scatters writes across the whole index and fragments it, while a time-ordered v7 appends to the end. Versions 1 and 6 embed a MAC address and can leak which machine generated them.
| Storage | Size per row | Notes |
|---|---|---|
CHAR(36) | 36 bytes | Readable in queries; largest index |
BINARY(16) / uuid | 16 bytes | PostgreSQL has a native type; MySQL needs UUID_TO_BIN() |
| Base64url text | 22 bytes | Compact for URLs, not standard |
Practical uses
Idempotency keys on payment APIs, correlation IDs threaded through logs and traces, file names for uploads so two users cannot overwrite each other, and seed data for tests. A UUID is not a secret — it is unguessable, but it is also unauthenticated, so never use one as a session token or a password-reset code without server-side validation and expiry.
Formatting conventions
Lowercase with hyphens is the canonical form defined by the specification, and the one to emit. Braces come from the Windows registry and COM; the URN form urn:uuid:… appears in XML and RDF; the hyphen-free 32-character form is common in MongoDB and in URLs. All represent the same 128 bits, so parsers generally accept any of them.
Frequently asked questions
Are these UUIDs truly random?
They use the browser cryptographic random generator via crypto.randomUUID(), the same source used for encryption keys — not Math.random().
Could two people generating UUIDs here get the same value?
The chance is negligible: about one in 2.7 quintillion pairs. Nothing is shared between visitors because generation happens entirely on each device.
Should I use UUID v4 as a database primary key?
It works, but random values fragment B-tree indexes. If write throughput matters, use a time-ordered UUIDv7 or keep a separate auto-increment key.
Is a UUID safe to use as a secret token?
No. It is unguessable but carries no authentication. Treat it as an identifier, not a credential.
Privacy
This tool runs entirely inside your browser using WebAssembly and the Canvas/File APIs. Your files are never uploaded to ToolFlint or any third party; you can verify this in your browser's network tab or by switching to airplane mode after the page loads. Read how we process files.
Last updated 2026-09-23.