UUID Generator - Bulk Random v4 UUIDs (GUID)

Reading a v4 UUID

Every UUID is 128 bits written as 32 hexadecimal digits in five hyphen-separated groups of 8, 4, 4, 4, and 12 characters. That makes 36 characters with hyphens, 32 without. Example: 3f2b8c1e-9d4a-4f6b-a2c7-5e1d0b9a7c34.

Two positions are fixed. The first digit of the third group is the version, and in a v4 UUID it is always 4. The first digit of the fourth group is the variant, and for standard UUIDs it is always 8, 9, a, or b. Those markers use 6 of the 128 bits. The other 122 bits are random, which is where all the uniqueness comes from.

Quick sanity check for any ID someone hands you: if the third group does not start with 4, it is not a v4 UUID. If it starts with 1, it is a v1 (timestamp plus MAC address); if 7, it is the newer time-ordered v7.

How this generator makes them

The tool calls crypto.randomUUID(), the browser's built-in v4 generator, which draws from the same cryptographically secure random source used for TLS keys. In the rare browser or context where that function is not available, it falls back to crypto.getRandomValues() to fill 16 random bytes, then sets the version and variant bits by hand. Either way, Math.random() is never used; it is not designed to be unpredictable.

Choose a count from 1 to 500 and generate. Two formatting options cover most systems: uppercase, for Microsoft tooling and some SQL Server exports that display GUIDs in capitals, and remove hyphens, for compact 32-character keys in URLs, filenames, or databases that store them as fixed-width strings. Copy all puts the whole list on your clipboard, one UUID per line, ready for a seed script or a CSV.

RFC 9562 says UUIDs should be written in lowercase and read case-insensitively, so lowercase is the safe default and the uppercase option is there for compatibility, not correctness.

The collision math, with real numbers

122 random bits means 2^122 possible values, about 5.3 x 10^36. The birthday problem says duplicates appear much sooner than that, roughly around the square root. The approximation for a 50 percent chance of at least one collision is n = sqrt(2 x 2^122 x ln 2), which works out to about 2.71 x 10^18, or 2.71 quintillion UUIDs.

To put that in scale: generate 1 billion UUIDs every second and you hit 2.71 quintillion after about 86 years. Want a less dramatic threshold? You would need about 103 trillion v4 UUIDs for a one-in-a-billion chance of a single duplicate.

Real-world collisions almost always come from broken randomness, not bad luck: a seeded pseudo-random generator, a cloned virtual machine replaying the same state, or a homemade UUID function built on Math.random(). Use a cryptographic source, which this tool does, and the math holds.

v4 vs v7: pick the right one

RFC 9562, published in 2024, replaced RFC 4122 as the UUID standard and added three new versions. The one that matters is v7. Its first 48 bits are a Unix timestamp in milliseconds, followed by random bits. New v7 IDs sort in creation order.

That ordering helps databases. Random v4 keys land all over a B-tree index, so heavy insert workloads in PostgreSQL or MySQL cause more page splits and cache misses. v7 keys append near the end, like an auto-increment integer, while staying globally unique.

v4 still wins when you do not want an ID to leak information. A v7 UUID reveals roughly when the record was created; a v4 reveals nothing. For public-facing IDs, test fixtures, idempotency keys, and anything where insert order does not matter, v4 is the simple choice. This tool generates v4 only.

Common mistakes

Storing UUIDs as 36-character strings in a large table. PostgreSQL has a native uuid type that uses 16 bytes; MySQL can use BINARY(16). The text version is more than twice the size and slower to compare.

Treating a UUID as a secret. It is unpredictable, but it is still an identifier that ends up in URLs, logs, and analytics. Use a purpose-built random token for password resets and API keys.

Validating with a sloppy regex. If your code only accepts v4, check that the version digit is 4 and the variant digit is one of 8, 9, a, or b, not just that the string has 36 characters.