Tools › Developer › UUID generator
UUID generator
Generate v4 and v7 UUIDs in bulk, from your browser's own cryptographic random source, so they are as unguessable as the ones your server would make.
- Uses crypto.getRandomValues, not Math.random, which matters more than it sounds
- v7 as well as v4: time-ordered, so they index without fragmenting a B-tree
- Thousands at a time, copied or saved as a file
- Generated here, so nothing is logged anywhere and no two people get the same list
Check a UUID
v4 or v7
v4 is 122 bits of randomness and nothing else. It is the right default: it leaks nothing, collides never in practice, and can be generated anywhere without coordination.
v7 puts a millisecond timestamp in the top 48 bits and randomness in the rest. That makes it sort by creation time, which matters enormously if it is a primary key. Random keys land all over a B-tree index and every insert dirties a different page; time-ordered keys land at the end, which is the difference between an index that fits in cache and one that does not. Use v7 for database keys and v4 for everything else.
The cost of v7 is that it reveals roughly when the record was created. For a public identifier where that matters (a password reset link, a share token) use v4.
Why the random source matters
Math.random() is not a cryptographic generator. It is seeded predictably and
its output can be reconstructed from a handful of previous values. A UUID made from it is
fine as a key and useless as a secret: anyone who has seen a few can work out the next.
These use crypto.getRandomValues, the browser's cryptographic source, which
is the same class of generator your server would use. That is why a UUID from this page is
safe to use as an unguessable token and one from a naive generator is not.
What the version and variant digits are
Two positions are not random. The 13th hex digit is the version (4 or 7) and the 17th is the variant, always one of 8, 9, a or b. So a v4 UUID has 122 random bits, not 128, and any UUID whose 13th digit is not 4 is not a v4 whatever it is labelled.
That is a quick way to check one by eye: f47ac10b-58cc-4372-a567-…
Will they ever collide
No, at any scale you will ever operate at. To reach a one-in-a-billion chance of a single collision you need around 100 trillion v4 UUIDs. Generating a billion a second, that is several thousand years. The practical risk is a broken generator, not the mathematics, which is the other reason the random source is the thing to care about.
Questions
Are these generated on a server?
No. They are generated in this tab by your own browser, so nobody logs them and no two visitors can be handed the same list.
Which version should I use?
v7 for database primary keys, because it sorts by time and indexes cleanly. v4 for anything that should reveal nothing, including tokens.
Are they safe to use as secret tokens?
A v4 from here, yes, it comes from the browser's cryptographic random source. A v7 is not secret, because it contains the time it was made.
Could two people get the same UUID?
No. At a billion a second it would take thousands of years to reach a one-in-a-billion chance of one collision.
Why is the 13th character always 4?
It is the version field, not random. The 17th is the variant and is always 8, 9, a or b. A v4 therefore carries 122 random bits, not 128.
Can I generate a lot at once?
Yes. Thousands, copied to the clipboard or saved as a file.