UUID Generator: v1, v4, v5, v7 Explained + Free Online Tool

Every modern application needs a way to give things unique identities — database rows, session tokens, distributed transactions, tracking events. The most common answer is a UUID: a 128-bit identifier that any system, anywhere, can generate on its own with virtually no chance of colliding with another.

This guide explains what UUIDs are, how each version's algorithm works, when to choose one version over another, and how UUIDs compare to traditional auto-increment database IDs. You can generate any version instantly, in bulk, with the ToolNest AI UUID Generator.

What Is a UUID?

A UUID (Universally Unique Identifier), sometimes called a GUID (Globally Unique Identifier in Microsoft terminology), is a 128-bit number typically represented as 32 hexadecimal digits grouped into five sections separated by hyphens:

f47ac10b-58cc-4372-a567-0e02b2c3d479

The defining property of a UUID is that it can be generated independently by any system — a client browser, a mobile app, a database server, a distributed microservice — without needing to check with a central authority to avoid duplicates. This makes UUIDs essential for distributed systems where multiple machines create records simultaneously.

UUIDs are standardized in RFC 9562 (published 2024), which supersedes the original RFC 4122 (2005) and adds new versions, most notably UUIDv7.

UUID Anatomy

A UUID string has 36 characters: 32 hexadecimal digits plus 4 hyphens, arranged as 8-4-4-4-12:

f47ac10b-58cc-4372-a567-0e02b2c3d479
└──1───┘ └2┘ └3┘ └4┘ └──────5──────┘

Group 3 contains the version number as its first hex digit — a 4 here means this is a version-4 (random) UUID. Group 4 contains variant bits in its first 1-3 bits, which identify the UUID layout variant (almost always the RFC 9562 variant, indicated by the digit starting with 8, 9, a, or b). The remaining bits, depending on version, are either random data, a timestamp, or a hash.

The Four UUID Versions That Matter

RFC 9562 defines eight UUID versions, but four cover the overwhelming majority of real-world use:

Version 1 — Timestamp + MAC Address

UUIDv1 encodes a 60-bit timestamp (100-nanosecond intervals since October 1582) and the network card's MAC address, plus a clock sequence to prevent collisions from clock adjustments. It was one of the original UUID versions but is used less today because embedding a MAC address can leak information about the machine that generated it — a privacy and security concern in public-facing systems.

Version 4 — Fully Random

UUIDv4 is generated using 122 bits of cryptographically secure random data (the remaining 6 bits are fixed to indicate version and variant). It contains no embedded information whatsoever — no timestamp, no hardware identifier — making it the safest default choice for general-purpose unique IDs, API tokens, and session identifiers.

Version 5 — Deterministic Name-Based

UUIDv5 generates a UUID by taking a SHA-1 hash of a namespace UUID combined with a name string. The critical property: the same namespace and name always produce the same UUID. This makes v5 useful when you need a stable, reproducible identifier derived from existing data — for example, generating a consistent ID for a URL, an email address, or a file path without storing a lookup table.

// Example: deterministic UUID from a URL
uuidv5("https://example.com/page", NAMESPACE_URL)
// Always produces the same UUID for this exact URL

Version 7 — Unix-Timestamp Sortable (Newest Standard)

UUIDv7, formalized in RFC 9562 (2024), embeds a 48-bit Unix millisecond timestamp in the most significant bits, followed by 74 bits of random data. Because the timestamp occupies the leading bits, UUIDv7 values sort chronologically when compared as raw bytes or strings — solving one of UUIDv4's biggest practical drawbacks for database use.

Why UUID Collisions Are Practically Impossible

A UUIDv4 has 122 random bits, giving 2¹²² ≈ 5.3 × 10³⁶ possible values. Using the birthday paradox approximation, you would need to generate roughly 2.7 × 10¹⁸ UUIDs before there is even a 50% chance of a single collision. At a rate of one billion UUIDs generated per second, that threshold takes over 85 years to reach — and that's for a 50% chance of just one collision across your entire dataset, not a guarantee.

In practice, the only realistic risk of UUID collision comes from a broken random number generator, not the birthday math. This is why UUID libraries insist on cryptographically secure randomness (crypto.randomUUID() in JavaScript, os.urandom in Python) rather than a simple pseudo-random generator.

UUID vs Auto-Increment Integer IDs

The most common real-world decision developers face is whether to use UUIDs or traditional auto-increment integers as database primary keys.

Choose UUIDs when:

• Multiple servers or clients need to generate IDs independently (distributed systems, offline-first apps)
• IDs will be exposed in public URLs and must not reveal information (e.g., total user count, growth rate)
• You need to merge data from multiple separate databases without ID collisions

Choose auto-increment integers when:

• A single database is the sole writer, and there's no need for distributed generation
• Storage size and raw index performance matter (integers are 4-8 bytes vs. 16 for UUIDs)
• You're not exposing the ID publicly, so sequential predictability is not a security concern

The middle ground — UUIDv7: Because UUIDv7 embeds a sortable timestamp, it gets the distributed-generation benefits of UUIDs while avoiding the index fragmentation problem that plagues UUIDv4 as a primary key. As of 2024-2025, UUIDv7 is increasingly the recommended default for new systems that need UUID semantics without the performance penalty.

How to Use the UUID Generator

The ToolNest AI UUID Generator runs entirely in your browser using the Web Crypto API for cryptographically secure randomness — nothing is sent to a server.

To generate a single UUID:

1. Select the version (v4 is selected by default)
2. Click "Generate New" to produce a fresh UUID
3. Click "Copy" to copy it to your clipboard

To generate UUIDs in bulk:

1. Choose a quantity from the bulk dropdown (10, 50, 100, or a custom count)
2. Click generate — all UUIDs appear in the output box
3. Use "Copy All" or download as .txt, .csv, or .json

To change the output format: Choose between lowercase with hyphens (the default, e.g. f47ac10b-58cc-4372-a567-0e02b2c3d479), UPPERCASE, no hyphens (f47ac10b58cc4372a5670e02b2c3d479), or wrapped in braces ({f47ac10b-58cc-4372-a567-0e02b2c3d479} — the Microsoft GUID convention used in Windows registry keys and COM).

To generate a deterministic v5 UUID:

1. Select v5 mode
2. Choose a namespace (URL, DNS, OID, or custom)
3. Enter the name string
4. The same namespace + name will always produce the same UUID

UUIDs in Different Languages

JavaScript (browser and Node.js 19+):

crypto.randomUUID();
// → "f47ac10b-58cc-4372-a567-0e02b2c3d479"

Node.js (npm package uuid):

const { v4, v5, v7 } = require('uuid');
v4();  // random
v5('https://example.com', v5.URL);  // deterministic
v7();  // time-sortable

Python:

import uuid
 
uuid.uuid4()   # random
uuid.uuid5(uuid.NAMESPACE_URL, "https://example.com")  # deterministic
uuid.uuid1()   # timestamp + MAC

PHP:

// Requires the ramsey/uuid package
use Ramsey\Uuid\Uuid;
Uuid::uuid4()->toString();

Java:

java.util.UUID.randomUUID().toString();

Go:

import "github.com/google/uuid"
id := uuid.New() // v4

SQL (PostgreSQL):

SELECT gen_random_uuid(); -- built-in since PostgreSQL 13

SQL (MySQL):

SELECT UUID(); -- returns UUIDv1 by default

Common Mistakes

Mistake 1: Using UUIDv1 in public-facing applications. The embedded MAC address can be extracted from a v1 UUID, potentially revealing information about the server hardware that generated it. Use v4 or v7 instead unless you specifically need v1's timestamp-ordering with legacy system compatibility.

Mistake 2: Using UUIDv4 as a primary key on a very large, high-write table. Random UUIDs cause new rows to insert at random positions in a B-tree index, leading to page splits and fragmentation that degrades write performance at scale. UUIDv7's sortable timestamp prefix solves this by keeping inserts sequential.

Mistake 3: Treating a UUID as a secret token. A UUID being hard to guess does not make it a security credential. If a UUID is used as a password reset token or API key, ensure it was generated with a cryptographically secure random source (not Math.random() in JavaScript) and treat it as sensitive data requiring the same protections as any other secret.

Mistake 4: Assuming all UUID libraries default to v4. Some older libraries and database functions (like MySQL's UUID()) default to v1. Always check which version a function produces if you have downstream logic that depends on the format (e.g., relying on chronological sortability, which only v1 and v7 provide).

Mistake 5: Comparing UUIDs as strings without normalizing case. UUIDs are technically case-insensitive (hex digits a-f can be upper or lowercase), but a naive string comparison (===) will fail if one UUID is uppercase and the other lowercase. Always normalize to lowercase before comparing.

Frequently Asked Questions

What is a UUID?

A UUID (Universally Unique Identifier) is a 128-bit number, usually represented as a 36-character string of hexadecimal digits and hyphens, used to identify data without requiring a central coordinating authority. Any system can generate a UUID independently with a near-zero probability of it colliding with another UUID generated anywhere else. UUIDs are standardized in RFC 9562.

What's the difference between UUID and GUID?

They are the same concept. "UUID" (Universally Unique Identifier) is the term used in the IETF standard (RFC 9562). "GUID" (Globally Unique Identifier) is Microsoft's name for the identical concept, used throughout Windows, .NET, and COM. The formats are interchangeable.

Which UUID version should I use?

For most general-purpose use cases — API resource IDs, session tokens, distributed record identifiers — use v4 (fully random). If the UUID will be a database primary key on a large, high-write table, use v7 for its sortable timestamp and better index performance. If you need the same input to always produce the same UUID (for deduplication or deterministic caching), use v5. Avoid v1 unless you specifically need compatibility with legacy timestamp-based systems.

Can two UUIDs ever collide?

Mathematically, yes — but the probability is astronomically small for UUIDv4. With 2¹²² possible values, you would need to generate about 2.7 quintillion UUIDs before reaching a 50% chance of a single collision. In practice, collisions only occur due to a broken or predictable random number generator, not the algorithm itself. Always use a cryptographically secure random source when generating UUIDs.

Is a UUID the same as a hash?

No. A hash (like SHA-256) is a fixed-size digest derived deterministically from input data — the same input always produces the same hash, and any change to the input changes the hash completely. A UUIDv4 has no relationship to any input data; it is pure randomness. UUIDv5, however, is conceptually similar to a hash — it is deterministic and derived from a namespace and name via SHA-1.

Why does UUIDv7 sort chronologically but UUIDv4 doesn't?

UUIDv7 places a 48-bit Unix millisecond timestamp in the leading bits of the UUID. When UUIDs are compared byte-by-byte (as strings or raw bytes), the leading bits dominate the comparison, so UUIDs generated later will always sort after UUIDs generated earlier. UUIDv4 has no timestamp component — every bit (except the fixed version/variant bits) is random, so there is no inherent ordering.

Can I generate a UUID without an internet connection?

Yes. The ToolNest AI UUID Generator runs entirely in your browser using the Web Crypto API — no data is sent to a server, and once the page is loaded, it works fully offline. This is also true of UUID generation in general: because UUIDs don't require central coordination, any offline system can generate valid, collision-resistant UUIDs.

How do I generate a deterministic UUID from a string?

Use UUID version 5, which hashes a namespace UUID and a name string together using SHA-1. Standard namespaces are predefined for URLs, DNS names, and OIDs (e.g., NAMESPACE_URL for URLs). Given the same namespace and the same name string, v5 will always produce the exact same UUID — useful for generating stable identifiers from external data like URLs or email addresses without maintaining a separate lookup table.