How to generate a UUID

A 36-character identifier you can create without asking anyone, and never expect to see twice.

A UUID is a 128-bit identifier written as 32 hexadecimal digits in five hyphenated groups. The point is that you can generate one locally, with no coordination, and rely on it not colliding with anyone else's.

Step-by-step

1. Generate one, or a batch.
2. Copy. Upper or lower case as you prefer — they are equivalent, though lower case is conventional.

122 random bits, not 128

Six of the 128 bits are not random. Four encode the version — the 4 that always appears at the start of the third group — and two encode the variant, which is why the fourth group always begins 8, 9, a or b. The tool marks both so you can see them.

This is worth knowing for one reason: 122 bits is still an enormous amount of randomness, but a version 4 UUID is not 128 bits of unpredictability, and anyone treating one as a security token should be counting the real figure.

Do not use a UUID as a secret

This is the mistake that matters. UUIDs turn up as password reset tokens and unguessable URLs, and version 4 UUIDs from a cryptographic generator are genuinely hard to guess. But there is no guarantee that any given UUID you encounter came from a cryptographic generator — plenty of libraries have historically used ordinary random number generators, and other UUID versions embed the timestamp and the machine's MAC address, making them predictable by design.

Will they collide?

Not in any practical sense. With 122 random bits you would need to generate on the order of a quintillion UUIDs before a collision became likely. If you ever see a duplicate, the cause is a bug in whatever produced it, not chance.

Frequently asked questions

Are these generated locally?

Yes, using crypto.getRandomValues() in your browser. Nothing is transmitted.

Which version does this produce?

Version 4, the fully random one, which is the right default when you simply need a unique identifier.

Can I use a UUID as a password reset token?

It is better to generate 32 random bytes and be explicit about it. Version 4 UUIDs from a good generator are hard to guess, but 'UUID' does not itself promise cryptographic randomness, and relying on that implicitly is fragile.