Generate UUIDs in bulk
Crypto-random v4 UUIDs straight from Web Crypto. Toggle uppercase, drop hyphens, and grab as many as you need. Runs entirely in your browser.
Click Generate to mint 5 fresh UUID v4 values. Each call uses 122 bits of cryptographic randomness — collisions are negligible.
Need time-ordered IDs for database primary keys? Try the UUID v7 generator instead.
Click Generate to mint UUIDs
How to generate UUIDs: a complete step-by-step guide
A UUID (Universally Unique Identifier) is a 128-bit value originally specified in RFC 4122 and refined in RFC 9562 (2024). The canonical text form is 32 hex digits in 8-4-4-4-12 groups — xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx — where M encodes the version and the high bits of N encode the variant. This tool mints v4 (random) UUIDs via crypto.randomUUID(), which draws 122 bits from a CSPRNG and sets the version/variant bits per spec.
- 01
Pick how many UUIDs to mint
Pick a preset count (1, 5, 10, 25, 100) or type any value up to 1000. Each call to
crypto.randomUUID()is independent — bulk generation just loops N times. The browser's CSPRNG is seeded from OS entropy, so quality is identical whether you mint one or a thousand.Need monotonically increasing IDs for database primary keys? Switch to UUID v7 — it embeds a millisecond timestamp in the top 48 bits for index-friendly insertion order.
bulkCSPRNGWeb Cryptov4 randomv7 time-orderedcount · selector51 · 5 · 10 · 25 · 100
count setready - 02
Choose case and hyphen format
The canonical form is 36 characters: 32 lowercase hex digits plus four hyphens. Toggle UPPER to uppercase the hex (matches Windows GUID display, SQL Server output). Toggle No hyphens to drop separators for a compact 32-char string — useful for URL slugs, filenames, or storing as a raw 16-byte
BINARY(16)column.Case and hyphenation are display only; the underlying 128 bits are identical and both forms parse identically with any standard UUID library.
RFC 4122 § 38-4-4-4-1232 chars36 charsdisplay onlyformat · caselower · hyphensxxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
format setcanonical - 03
Mint cryptographically random UUIDs
Each UUID v4 carries 122 bits of pure randomness (6 bits are fixed: 4 for the version
4, 2 for the RFC 4122 variant). That's 2^122 ≈ 5.3×10^36 possible values — generating one per nanosecond for the age of the universe still gives a collision probability so small it's rounding error.Internally we call the browser's native
crypto.randomUUID()— same primitive Node.js, Deno, and modern runtimes share — so the entropy source is the OS-level CSPRNG (e.g.getrandom(2)on Linux,BCryptGenRandomon Windows).122 bitsRFC 9562crypto.randomUUIDversion 4variant RFCoutput · uuid v45 idsb9c4e0d9-7e51-4a8d-9c0f-cdda5b78e1a4
36 B · 1 linev4 · ready - 04
Copy, download, or pipe into your code
Click Copy all to send the newline-separated list to your clipboard, or download as
.txtfor fixtures, seed data, or one-off scripts. Each line is a complete, RFC-valid UUID.For shorter IDs the Nano ID or ULID generators offer alternatives; for human-friendly slugs try Slugify. To verify uniqueness with a hash, run them through the SHA-256 Generator.
clipboard.txtfixturesseed dataprivacy-firstexport · actions2 actions✓ Copied 5 UUIDs to clipboard ✓ Saved: uuids.txt ✓ 100% client-side
ready to ship0 outbound
Encoding without surprises
Always UTF-8 first
Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.
URL-safe vs standard Base64
Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.
Hashes aren’t passwords
SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.
Watch padding rules
Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.
Use Web Crypto for keys
Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.
JWT decode ≠ verify
Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.
When to use UUIDs
Primary keys, correlation IDs, idempotency tokens.
Distributed primary keys
Generate IDs client-side without coordinating with a database sequence. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.
RFC-compliantCorrelation IDs
Trace a request through multiple services. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.
OpenSSL-matchedIdempotency keys
Safely retry POST requests without duplicating work. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.
losslessFilename collisions
Save uploaded files under unique names. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.
byte-identicalSession IDs
Random session tokens without server lookups. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.
spec-gradeTest fixtures
Generate unique inputs in unit and integration tests. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.
production-readyFrequently asked questions
Something missing?
Tell us what you need. We ship the top requests every two weeks.