UUID Generator

What this tool does

A UUID, a universally unique identifier, is a value of 128 bits that programs create on their own, without asking a central authority, and that is nevertheless unique for all practical purposes. It is usually written as 32 hexadecimal digits in five groups.

The tool creates UUIDs of version 4, which are random, and of version 7, which begin with the current time and therefore sort in the order of their creation. Both are defined in RFC 9562. It also creates ULIDs, a time-ordered format with 26 characters, and it reads any UUID or ULID you paste.

How to use it

1. Choose the version.
2. Enter how many identifiers you need, from 1 to 1000.
3. Choose the spelling: with or without hyphens, in lower or upper case.
4. Select “Generate”. Each time you select it, new identifiers are created.
5. Copy the list or download it as a text file with one identifier per line.

How the result is derived

The random bits come from the random number generator of your browser that is meant for cryptographic use (crypto.getRandomValues). The function Math.random is not used.

For version 4 the tool takes 16 random bytes and overwrites six bits: four bits with the version number 4 and two bits with the variant. 122 bits remain random.

For version 7 the first 48 bits hold the current time as a Unix timestamp in milliseconds. Then follow the version number 7, 12 random bits, the variant and another 62 random bits. 74 bits are random. All identifiers created in one run carry the same timestamp and share their first 48 bits; their order among each other is random.

Worked example

RFC 9562 shows how a version 7 identifier is put together for the time 2022-02-22T19:22:22Z, which is the timestamp 1645557742000 or 017F22E279B0 in hexadecimal.

017F22E2-79B0-7CC3-98C4-DC0C0C07398F

017F22E2-79B0   timestamp in milliseconds, 48 bits
7               version
CC3             random, 12 bits
9               variant (binary 10) and the first 2 random bits
8C4-DC0C0C07398F  random, the other 60 bits

In every UUID of these versions the first digit of the third group is the version. The first digit of the fourth group is 8, 9, a or b, because its first two bits are the variant.

Reading a UUID or ULID

Choose “Read a UUID or ULID” and paste one; hyphens in the usual 8-4-4-4-12 places, braces, a urn:uuid: prefix and letter case do not matter. The tool shows the version and the variant from the bits RFC 9562 reserves for them, and the time where the identifier carries one:

• Versions 1 and 6 hold a 60-bit count of 100-nanosecond steps since 15 October 1582, the start of the Gregorian calendar, plus a clock sequence and a node, which in version 1 is often the MAC address of the machine. RFC 9562, appendix A.1, gives C232AB00-9414-11EC-B3C8-9F6BDECED846, which the tool reads as 2022-02-22T19:22:22.0000000Z with node 9f:6b:de:ce:d8:46.
• Version 7 and ULIDs start with 48 bits of Unix time in milliseconds.
• Versions 3, 4 and 5 contain no time. The layout of version 8 is up to its vendor, so the tool shows no time for it.

A ULID follows its own specification, published on GitHub, not an IETF standard: 48 bits of time and 80 random bits, written in Crockford’s Base32 without the letters I, L, O and U. The largest value is 7ZZZZZZZZZZZZZZZZZZZZZZZZZ; anything above it does not fit in 128 bits and is rejected, as the specification says implementations should. The tool generates a batch of ULIDs in the specification’s monotonic way: the first one gets a random part and each next one that part plus one, so the batch sorts in the order it was made.

Because both are 128 bits, a ULID can be written as a UUID and the other way round; the tool shows both forms. A ULID written as a UUID is not a version 7 UUID, though: its version and variant positions hold ordinary bits.

Reference: versions of UUIDs

The text form has 36 characters with hyphens, in groups of 8, 4, 4, 4 and 12 digits. Upper and lower case mean the same value, and the standard allows both.

Version 7 suits keys of database tables, because values created one after the other are close to each other in an index. It also reveals when an identifier was created. Version 4 reveals nothing.

Common mistakes

• Using a UUID as a secret. The standard says that UUIDs must not be used as identifiers whose mere possession grants access.
• Comparing UUIDs as text without normalizing the case.
• Storing UUIDs as text where the database can store the 128-bit value. The standard recommends the binary form where it is feasible.
• Expecting version 4 identifiers to sort by creation time.
• Creating identifiers with a random number generator that is not meant for cryptography. Its output can repeat or be predicted.

Sources

• RFC 9562: Universally Unique IDentifiers (UUIDs)
• ULID specification
• MDN: Crypto.getRandomValues()