What a UUID is
A UUID (universally unique identifier), also called a GUID in the Microsoft world, is a 128-bit value written as 32 hexadecimal digits in five groups, for example 3f2504e0-4f89-41d3-9a0c-0305e82c3301. They are used wherever systems need identifiers that can be created independently, without asking a central database for the next number: database primary keys, file names, session IDs, message IDs and correlation IDs in logs. The format is defined in RFC 4122 and its updates.
What version 4 means
There are several UUID versions. Version 1 uses a timestamp and a machine address, and version 5 hashes a name. Version 4, generated here, is built from random numbers. Of the 128 bits, 6 are fixed to mark the version (the first digit of the third group is always 4) and the variant (the first digit of the fourth group is 8, 9, a or b), which leaves 122 random bits. That is about 5.3 × 10^36 possible values.
How likely is a collision?
With 122 random bits, the chance of two random UUIDs matching is vanishingly small. You would need to generate roughly a billion UUIDs per second for around 85 years before the probability of even a single duplicate reached 50%. For practical purposes, they are unique, provided the random numbers are good. This tool uses the browser's cryptographically secure random generator, not the weaker Math.random.
Formatting options
- Uppercase: some systems display GUIDs in capital letters. Case does not change the value.
- No hyphens: a compact 32-character form that some APIs and databases prefer.
- Braces: the {…} form seen in Windows registry entries and some .NET code.
Good practice
Random UUIDs make poor sort keys, since new rows land in random positions of a database index. If insertion order matters, consider time-ordered identifiers. A UUID is also not a secret, so do not use one as a password or authorisation token on its own. For secrets, use the password generator. Generation is local, and nothing is saved or sent.