UUID Generator guide

What a UUID is

A universally unique identifier (UUID), also called a GUID in Microsoft ecosystems, is a 128-bit value written as 32 hexadecimal digits in five groups, such as 018f3a2e-7b1c-7d2a-9f4e-2b6c8a1d3e5f. Systems create UUIDs independently, without a central counter, and the chance of two random UUIDs colliding is negligible. That makes them popular as database keys, request IDs and file names.

RFC 9562 (2024) replaced the original RFC 4122 and added new versions, most importantly v7. Four bits of every UUID store the version, and two or three bits the variant, which is why the thirteenth hex digit shows the version number.

How to use the UUID Generator

1. Open the UUID Generator and choose the identifier type: UUID v4, UUID v7 or ULID.
2. Choose how many to generate and whether letters should be uppercase.
3. Press Generate and copy the identifiers.
4. To inspect an existing UUID, paste it into Decode a UUID to see its version, variant and embedded time.

Values are generated with the browser's secure random source and are not sent anywhere, so they can be used directly as identifiers in test data or configuration.

Choosing between v4, v7 and ULID

Random v4 keys scatter inserts across a database index, which causes page splits and cache misses on large tables. Time-ordered v7 keys append near the end of the index, similar to auto-increment integers, while keeping the benefits of UUIDs. For new systems that store UUIDs as primary keys, v7 is usually the better default.

Decoding a UUID

The version digit tells you how a UUID was made. For v1 and v7, the decoder also extracts the timestamp and shows it as a date. The variant is shown as well: values that follow RFC 9562 are labelled as such, while the NCS, Microsoft and future variants from older specifications are labelled as reserved.

Decoding is useful when debugging. A v7 key in a log line tells you when the record was created without a database query, and an unexpected v1 UUID in a new system points to an old library or a component that still uses time-and-node identifiers. The nil and max UUIDs show up as placeholders in test data and default values.

018f3a2e-7b1c-7d2a-9f4e-2b6c8a1d3e5f
               ^    ^
               |    variant: 9 → binary 10xx (RFC 9562)
               version: 7

f47ac10b-58cc-4372-a567-0e02b2c3d479
               ^    ^
               |    variant: a → RFC 9562
               version: 4 (random)

Generating UUIDs in code

Most platforms generate v4 UUIDs natively, and v7 support is spreading quickly in standard libraries and database extensions. When a platform lacks v7, small, well-maintained libraries implement RFC 9562; avoid writing your own timestamp packing unless you test it against the specification's examples. Whatever you use, make sure the random part comes from a cryptographically secure generator.

// Browser and Node.js: v4
crypto.randomUUID()

# Python 3: v4 (uuid7 is available in newer versions)
python3 -c "import uuid; print(uuid.uuid4())"

-- PostgreSQL: v4 built in
SELECT gen_random_uuid();

Generate identifiers where the record is created, usually in the application, so the ID is known before the database insert. That makes it possible to create related records, send events and return the new ID to the client without an extra round trip. It also works for offline clients that sync later.

In distributed systems, UUID v7's millisecond timestamp comes from each machine's clock. Values from machines with skewed clocks still sort roughly by time but not perfectly, so do not rely on UUID order alone for strict event ordering.

Storing UUIDs

Store UUIDs in a native UUID type where the database has one, such as uuid in PostgreSQL, or as 16 bytes of binary. The 36-character text form takes more than twice the space and makes indexes larger and slower. Convert to text only at the edges of the system, in APIs and logs.

CREATE TABLE orders (
  id uuid PRIMARY KEY,
  created_at timestamptz NOT NULL DEFAULT now(),
  customer_email text NOT NULL
);

-- application generates UUID v7 values, for example for an order from anna@example.com

• Compare UUIDs case-insensitively in text form; RFC 9562 recommends lowercase output.
• Do not use UUIDs as secrets. v4 values are hard to guess, but they are designed as identifiers, not access tokens.
• Do not parse meaning out of v4 UUIDs; only v1, v6 and v7 carry timestamps.

FAQ

Sources

• RFC 9562: Universally Unique IDentifiers (UUIDs)
• RFC 4122: A UUID URN Namespace (obsoleted by RFC 9562)
• ULID specification
• MDN: Crypto.randomUUID()