UUID generator
Generate random version 4 identifiers, in whichever form you need.
Identifiers
The randomness comes from the browser’s cryptographic source, and nothing is sent anywhere.
How it works
A UUID is a 128-bit identifier, written as 32 hexadecimal characters in five groups separated by hyphens.
Version 4 is random except for six bits that record the version and variant. That leaves 122 random bits, or something over five undecillion possible values, that is 5.3 × 10³⁶.
With that many possibilities no central authority has to hand identifiers out. Two systems can each generate one without asking the other, and the chance of a collision is negligible.
The randomness comes from the browser’s cryptographic random source, which exists precisely for values that must be impossible to guess.
The forms with uppercase letters or braces come from the Windows world. It is the same identifier, only written differently.
How the identifiers are made
The tool calls the browser’s crypto.randomUUID, which under the W3C Web Cryptography API creates a version 4 UUID from cryptographically secure random bytes. In older browsers without that function, the tool fills 16 bytes with crypto.getRandomValues itself and then overwrites six bits: the upper half of the seventh byte becomes 0100, meaning version 4, and the top two bits of the ninth byte become 10, which marks the variant. Up to 100 identifiers are made per batch. The options for capitals, braces and hyphens change only how the values are written, not the values themselves.
How to recognise version 4
The fixed bits show in the text. The first character of the third group is always 4. The first character of the fourth group is 8, 9, a or b, because only two of its four bits are fixed. In c3431ee8-4dd9-4038-b998-71210a2ffb2b, made with the tool’s own code, those characters are 4 and b. If anything else sits in those places, the identifier is not version 4. RFC 9562 allows the letters to be written in upper case, lower case or a mixture.
Edge cases
A UUID is an identifier, not a secret. RFC 9562 says implementations should not assume UUIDs are hard to guess, and that they must not be used as security capabilities, identifiers whose mere possession grants access. A password reset link needs a token designed for that job.
As a database key, version 4 has a drawback the standard itself points out: values created one after another land far apart in the index, so each new row is inserted at a random position. Version 7 starts with a timestamp and so sorts in the order the values were made. The tool makes only version 4.
Two values have names of their own in the standard: the nil UUID, all zeros, and the max UUID, all f. Neither can come out of the tool, because the version and variant bits are always set.