UUID generator (v4 and v7)
Generate 128-bit unique identifiers in RFC 9562 versions 4 and 7, and use the Validate tab to read the version, variant and embedded time of any UUID.
Up to 1000 items at once. Everything is generated in your browser.
How to use
- Pick the version: v4 (fully random) or v7 (starts with the current time in milliseconds).
- Set the format: uppercase and with hyphens (36 characters) or without hyphens (32 hex digits).
- Click Generate and Copy; for seed keys, set the Quantity (up to 1000) and use Export CSV or Export JSON.
- On the Validate tab, paste one or more UUIDs (one per line) and click Validate; uppercase, unhyphenated, braced and
urn:uuid:forms are accepted. - Each line shows valid/invalid, the reason, the version and, for v7, the UTC date and time.
How it works
Anatomy of a UUID
A UUID is 128 bits, written as 32 hex digits in the 8-4-4-4-12 layout. RFC 9562 fixes two fields: the version is the 13th hex digit (first of the 3rd group) and the variant lives in the top bits of the 17th digit (first of the 4th group), which for RFC UUIDs start with 10 — that is why this digit is always 8, 9, a or b.
- v4 (§5.4): 16 bytes from
crypto.getRandomValues, then the version (4) and variant bits are forced, leaving 122 random bits. Collisions are, in practice, impossible. - v7 (§5.7): the first 48 bits are the Unix timestamp in milliseconds (big-endian); the rest is random except the version and variant (74 random bits). Because time comes first, v7 values sort roughly by creation time, which improves locality in B-tree indexes in databases such as PostgreSQL and MySQL.
Decoded example
A UUID v7 generated on 2026-11-13 at 12:00:00 UTC: 01a1d4c7-6600-7c7d-9cd1-d6744db01075.
- The first 12 digits,
01a1d4c76600, equal 1,794,571,200,000 in decimal: milliseconds since 1970-01-01, i.e.2026-11-13T12:00:00.000Z. - 13th digit
7→ version 7. - 17th digit
9= binary1001; the top bits10mark the RFC 9562 variant. - The rest (
c7dandd1d6744db01075, minus the 2 variant bits) is random.
What the validator checks
After stripping urn:uuid:, braces and hyphens, the input must be exactly 32 hex digits. The Nil UUID (00000000-0000-0000-0000-000000000000, §5.9) and the Max UUID (ffffffff-ffff-ffff-ffff-ffffffffffff, §5.10) are recognised as special cases. Otherwise the variant must be 10 (if not: a variant error — e.g. legacy Microsoft GUIDs) and the version must be 1 to 8. For v7 the timestamp is shown in ISO 8601 UTC.
Note: this implementation has no monotonic counter, so two v7 values created in the same millisecond are ordered only by their random part.
FAQ
Should I use UUID v4 or v7?
Use v7 for primary keys and anything indexed or sorted: the leading part grows with time and reduces index fragmentation. Use v4 when the identifier must reveal nothing, not even when it was created, such as public tokens or IDs exposed in URLs.
Does a UUID v7 leak information?
Yes: its creation time to the millisecond, which anyone can read, including with this page’s Validate tab. That is usually fine for internal keys, but avoid v7 for public identifiers if the creation time is sensitive.
Are UUID and GUID the same thing?
Practically, yes: GUID is the name used in the Microsoft ecosystem. The catch is that some legacy GUIDs use the Microsoft-reserved variant (17th digit c or d), and .NET stores the first fields in little-endian byte order. The validator rejects the Microsoft variant with the reason “variant”.
Can I use a UUID as a password or secret token?
A v4 carries 122 random bits from a cryptographic generator, but RFC 9562 advises against assuming UUIDs are hard to guess. For secrets, use dedicated tokens of 128 to 256 random bits. Never use v7 as a secret, since part of it is a timestamp.
How should I store UUIDs in a database?
Use the native type: uuid in PostgreSQL, BINARY(16) in MySQL or uniqueidentifier in SQL Server. Storing 36-character text works but takes more than twice the space and slows indexes down. PostgreSQL 18 ships a native uuidv7() function.
Sources
Related tools
Updated 2026-11-13 · Rafael Lima