UUID Generator

Where does the randomness come from?

The 16 random bytes for each UUID come from the browser’s Web Crypto API (crypto.getRandomValues), a cryptographically secure source. If that API were unavailable the code falls back to Math.random, which is not suitable for secrets, but all current mainstream browsers provide Web Crypto.

Which UUID version is this, and what does that mean?

Version 4, the random kind. Of the 128 bits, 6 are fixed (4 for the version and 2 for the variant) and 122 are random. You can see the version as the first character of the third group, always 4, and the variant as the first character of the fourth group, always 8, 9, a or b.

Can two generated UUIDs collide?

In principle yes, in practice no. With 122 random bits you would need to generate roughly 2.7 quintillion (2.7 × 10^18) UUIDs to reach a 50% chance of a single duplicate. Duplicates in real systems nearly always come from copying an ID, not from bad luck.

Is there a limit on how many I can generate?

Yes, 100 per run. A request for 500 returns 100, and anything below 1 or non-numeric returns 1. The Count row shows how many were produced. Every change to the options generates a fresh set, and nothing is stored, so copy the list before adjusting settings.

What are the four formats for?

Standard is the lowercase 8-4-4-4-12 form that the specifications say to output. No hyphens gives 32 hex digits for compact keys or file names. UPPERCASE and braces match the style many Windows and .NET tools use for GUIDs. They are the same value written differently, and parsers should treat letter case as irrelevant.

Should I use UUID v4 as a database primary key?

It works, but random values insert at random positions in an index, which can slow writes on very large tables compared with sequential keys. RFC 9562, published in 2024, defines version 7, whose leading bits are a timestamp so new IDs sort in creation order. This tool only generates v4.

Can I use a UUID as a secret or access token?

Treat it as an identifier. A v4 UUID from a secure generator is hard to guess, but it has a fixed, publicly known layout and only 122 random bits, and IDs often end up in logs and URLs. For passwords, session or API tokens use a purpose-built random token generator.