DevClamp

UUID Generator

Generate random UUID v4 values in bulk — up to 100 at a time, with case and hyphen options — using your browser's cryptographic random source. Free, no sign-up — runs locally in your browser.

What a UUID is, and what v4 promises

A UUID (universally unique identifier) is a 128-bit value written as 32 hexadecimal digits in five groups — 8-4-4-4-12 — for a total of 36 characters including the hyphens. The idea, dating to the 1980s and standardised as RFC 4122 (now RFC 9562), is radical in its simplicity: any computer, anywhere, can mint a new identifier without asking a central authority, and the identifier will — with overwhelming probability — never be minted again by anyone else. Version 4 is the purely random flavour: of the 128 bits, 122 come straight from a random number generator, and the remaining 6 are fixed markers that announce "this is a variant-1, version-4 UUID". You can spot them in the wild by those markers: the third group always starts with 4, and the fourth group always starts with 8, 9, a or b. Everything else is chance.

How to use this generator

  1. Choose how many you need — one for a quick test fixture, or a batch of up to 100 for seeding a table or a test run.
  2. Set the format first. Lowercase with hyphens is the canonical form most systems expect; tick UPPERCASE or untick Hyphens only when the receiving system asks for it.
  3. Press Generate UUIDs. Every press is a fresh batch from the browser's cryptographic random source — pressing it twice never repeats a list.
  4. Copy what you need: the button on each row takes that single UUID, and Copy all takes the whole batch, one per line, ready to paste into code, SQL or a seed file.

Where the randomness comes from

A UUID generator is only as good as its entropy, so this page is explicit about its source: it calls crypto.getRandomValues, the browser's interface to the operating system's cryptographically secure random generator — the same source used to mint the keys that protect TLS connections. It never uses Math.random, which is a fast, predictable PRNG designed for games and shuffling playlists: its future outputs can be reconstructed from a few observed ones, which for identifiers that double as unguessable tokens (password-reset links, API keys, session IDs) is a real vulnerability, not a theoretical one. If a generator does not tell you where its randomness comes from, assume the answer is the bad one.

UUIDs in practice

The places you will meet v4 UUIDs: primary keys in distributed databases, where several servers insert rows without coordinating; object-storage and file names, where the name itself must not collide or leak how many files exist; idempotency keys on payment and API requests, where a retried request must be recognisable as the same request; and correlation IDs sprinkled through logs so one user action can be traced across five services. Two practical notes from the field. First, store them as 16-byte binary (or a native UUID type) rather than 36-character text when your database offers it — half the index size, and comparisons get faster. Second, a v4 UUID in a URL is unguessable but it is not an access control: anyone you show the link to has the ID, so check permissions on the server anyway. Unguessable means strangers cannot enumerate your records; it does not mean the bearer of the link is authorised.

Frequently asked questions

What makes a UUID a "version 4" UUID?

Of the 128 bits in a v4 UUID, 122 are random and 6 are fixed bookkeeping: four bits in the third group read 4 (the version), and the first bits of the fourth group read 10 (the variant). That is why every v4 UUID looks like xxxxxxxx-xxxx-4xxx-[89ab]xxx-xxxxxxxxxxxx — the 4 and the 8/9/a/b are not random, they are the label that tells any parser how the rest was made.

How random are these, really? Could two ever collide?

They are drawn from your browser's cryptographic random source (crypto.getRandomValues, the operating system's CSPRNG) — the same grade of randomness used for session tokens. With 122 random bits, you would need to generate roughly 2.7 quintillion UUIDs before the odds of one duplicate reach 50%, and at a billion per second that takes about 86 years. In practice, systems break long before UUID collisions matter — which is precisely why UUIDs are used as database keys and public identifiers without a central counter.

Should I use uppercase or strip the hyphens?

The canonical form is lowercase with hyphens, and that is what most systems store and compare. Uppercase is for the odd legacy system (some Windows tooling displays GUIDs uppercase) — note that a case-sensitive comparison treats the two forms as different strings even though they name the same UUID. Stripping hyphens gives a 32-character hex string some APIs prefer; it loses nothing, since the grouping is fixed and can always be re-inserted. Pick the form the receiving system expects, and be consistent.

UUID v4 or v7 — which should I generate?

v7 embeds a millisecond timestamp, so its values sort in creation order, which makes database indexes noticeably happier; v4 is pure random and reveals nothing about when it was made. The ecosystem is moving toward v7, but v4 remains the most widely recognised and the safest default when values cross systems you do not control. This generator makes v4; if you need v7 for an index-friendly key, generate a v4 here only for throwaway IDs, not as a substitute.

Are the generated UUIDs stored or sent anywhere?

No. They are generated in your browser from its own random source and exist only in this tab. Nothing is logged, uploaded or kept — close the tab and the list is gone, which is why there is a Copy all button: take the batch with you.

Related tools

Regex Tester

Test regular expressions against your text with every match highlighted, a full match list and capture groups — plus one-click patterns for emails, URLs and dates.

Text Diff Checker

Compare two texts line by line and see exactly what was added and removed — colour-blind-safe markup with + and − signs, all in your browser.

Hash Generator

Calculate MD5, SHA-1, SHA-256 and SHA-512 digests of any text as you type. Your input is hashed locally and never saved.