What Is a UUID?
A UUID (Universally Unique Identifier), also called a GUID in Microsoft terminology, is a 128-bit identifier used to name records, sessions, and objects without needing a central authority to hand out unique numbers. This uuid generator doubles as a guid generator (the two terms refer to the exact same 128-bit structure) and produces RFC-compliant UUIDs instantly in the browser, whether you need a single value from the uuid v4 generator or a batch of fifty for test fixtures. As a random uuid generator online, it never sends your generated values anywhere for the v4 case, the most commonly used version.
UUID Structure and Versions: v4, v7, and v1 Compared
A UUID is always 128 bits, written as 32 hexadecimal digits split by hyphens into an 8-4-4-4-12 pattern, for example 01909f4a-1e2b-7c3d-8a9f-6b2c1d4e5f60. Two small fields inside that layout carry metadata rather than payload: a 4-bit version field (one hex digit) identifies which algorithm produced the value, and a 2 to 3 bit variant field marks which layout rules the rest of the bits follow, almost always the standard RFC variant. UUID v4 generation, defined in RFC 4122, fills 122 of the 128 bits with cryptographically random data; whether uuid v4 is collision safe comes down to the birthday problem, and with 2^122 possible values, generating even billions of UUID v4 values keeps the collision probability effectively negligible. This tool generates uuid v4 using the browser's own crypto.randomUUID(), part of the Web Crypto API. As a uuid v7 generator, it produces UUID v7, added in RFC 9562 (2024), encodes a 48-bit Unix millisecond timestamp in its first bits, and the uuid v4 vs v7 choice comes down to this timestamp: because it sits at the most significant end, UUID v7 values sort in creation order as plain strings, avoiding the B-tree index fragmentation that random UUID v4 primary keys cause in Postgres and similar databases, which is why UUID v7 is now the recommended default for new database primary keys. UUID v1 encodes a 60-bit timestamp alongside a clock sequence and a 48-bit node identifier; the original spec used the generating machine's MAC address for that field, a well-documented privacy leak this tool avoids by substituting a random node ID instead.
Generating a UUID in JavaScript Without a Library
Most modern runtimes expose crypto.randomUUID() directly, a single Web Crypto API call that returns a fully formed, RFC-compliant UUID v4 string with no dependency needed. It requires a secure context (HTTPS or localhost) and has been available in all major browsers and Node.js since 2021, so there is rarely a reason to reach for a third-party UUID package just to generate uuid v4 values in a modern codebase.
Namespace UUIDs (v3 and v5): What This Tool Does Not Generate
UUID v3 (MD5-based) and UUID v5 (SHA-1-based) are deterministic: given the same namespace UUID and name string, they always produce the same output. That makes them useful for generating a reproducible ID from existing data, a different problem from the random or time-ordered identifiers this tool focuses on. If you need the same input to always produce the same UUID, v3 or v5 is the correct tool, not v4 or v7.
Validating a UUID (Regex Pattern and Common Mistakes)
A uuid regex validation pattern needs to check three things: the 36-character canonical form with hyphens in the right positions, that each character is a valid hex digit, and optionally that the version digit matches what you expect. A malformed UUID is most often caused by stripped hyphens, truncation during a copy-paste, or a database column that is too narrow. Storing UUIDs in a native UUID column type, where the database supports one, catches malformed values automatically instead of relying on application-level regex checks alone. This tool generates UUIDs, it does not generate namespace-based UUID v3 or v5 values, and it does not verify that a UUID you already have was generated correctly by another system beyond checking its structural format. Nothing generated here is a substitute for actual access control: a UUID's uniqueness comes from its size, not from being kept secret, so an unguessable UUID v4 alone should never be treated as an authorization token without additional checks.