UUID/GUID Generator

RFC 4122 / RFC 9562 Universally Unique Identifier (UUID) Specifications

A Universally Unique Identifier (UUID), also known in Microsoft ecosystems as a Globally Unique Identifier (GUID), is a 128-bit label standardized by RFC 4122 and recently updated by RFC 9562. UUIDs enable distributed systems to generate unique primary keys and entity identifiers without coordinating with a central registration authority or database sequencer.

A standard canonical UUID is represented as 32 hexadecimal characters grouped into five hyphen-separated blocks in the 8-4-4-4-12 format (36 characters total), such as f47ac10b-58cc-4372-a567-0e02b2c3d479.

Our generator utilizes the browser's native Cryptographically Secure Pseudo-Random Number Generator (window.crypto.getRandomValues) to guarantee genuine high-entropy UUID v4 generation, adhering strictly to RFC specifications.

Understanding UUID Versions: v1 vs v4 vs v7

Different UUID versions serve specific architectural needs:

• UUID v1 (Timestamp + MAC Address): Uses 60-bit system timestamp and 48-bit network node MAC address. Rarely used in modern web systems due to privacy leaks revealing physical network hardware addresses.
• UUID v4 (Random): 122 bits of pure cryptographic entropy. The probability of two UUID v4 values colliding is astronomically low (1 in 5.3 x 10^36), equivalent to generating 1 billion UUIDs every second for 85 years before a 50% collision probability.
• UUID v7 (Time-Ordered + Random - RFC 9562): The modern standard for database primary keys. Combines a 48-bit millisecond Unix timestamp with 74 bits of random entropy, ensuring chronological B-tree database index sorting while preventing page splits and fragmentation.

Programmatic UUID Generation in JavaScript, Python & CLI

// Modern JavaScript (Native Web Crypto - Node.js 16+ & Browsers)
const uuid = crypto.randomUUID();
console.log("UUID v4:", uuid);

# Python 3 uuid module
import uuid

v4 = uuid.uuid4()
print("UUID v4:", str(v4))

# Bash / Terminal CLI
# On macOS / Linux
uuidgen | tr '[:upper:]' '[:lower:]'

Why Math.random() Must Never Be Used for UUIDs

Naive UUID generators that rely on Math.random() are severely insecure. Math.random() uses a deterministic pseudorandom number generator (like xorshift128+) that can be easily predicted by observing past outputs, leading to predictable session IDs and account takeover vulnerabilities. Always enforce CSPRNG (crypto.randomUUID()).

RFC 4122 v4 vs RFC 9562 v7: Randomness vs Monotonic B-Tree Indexing

Universally Unique Identifiers (UUIDs) provide distributed systems with globally unique 128-bit entity identifiers without centralized database coordination. While Version 4 UUIDs rely purely on 122 bits of pseudo-random entropy generated by CSPRNG, their random distribution causes severe B-Tree Index Fragmentation in high-throughput transactional databases (PostgreSQL, MySQL InnoDB, CockroachDB), triggering frequent disk page splits and degraded INSERT throughput.

The newer RFC 9562 standard introduces UUIDv7, which solves this database performance bottleneck by encoding a 48-bit Unix millisecond epoch timestamp in the most significant bits followed by sub-millisecond sequence counters and 62 bits of cryptographic randomness. This produces monotonically increasing identifiers that maintain index locality and query cache efficiency while preserving global uniqueness.

Frequently Asked Questions