How can I tell that a UUID is version 4?

Look at the 13th hex digit, the first digit of the third group: it is 4 in every v4 UUID. The 17th digit, the first of the fourth group, is 8, 9, a, or b, which marks the RFC 9562 variant.

Are the letters uppercase or lowercase?

The tool writes lowercase hex, as crypto.randomUUID() returns it. RFC 9562 treats the hex digits as case-insensitive when reading a UUID, so convert to uppercase if your system expects it.

Where does the randomness come from?

From crypto.randomUUID(), which draws on the operating system's cryptographically secure random number generator. Browsers without randomUUID use crypto.getRandomValues, which reads the same kind of source.

Is the UUID sent to a server?

All generation runs in your browser using crypto.randomUUID(). Our servers are not involved at any point.

Random UUID generator

Generate a random UUID with one click. Each value is a version 4 UUID (RFC 9562) with 122 random bits, written as 32 lowercase hex digits in the 8-4-4-4-12 pattern and ready to copy. All generation runs in your browser using crypto.randomUUID().

Generated UUID

VERSION

Runs entirely in your browser

How it works

crypto.randomUUID() fills 122 of the 128 bits with cryptographically secure random data and fixes the other six: the 13th hex digit is always 4, the version, and the 17th is always 8, 9, a, or b, the variant. Browsers without randomUUID fall back to crypto.getRandomValues, and the tool sets the same bits by hand. The result is written in lowercase hex.

Processing runs in your browser

UUIDs are generated entirely in your browser. All processing happens locally in your browser tab. Our servers are not involved at any point. You can inspect this yourself in your browser's DevTools Network tab.

Technical specification

UUID version 4 (random) is defined in RFC 9562 (IETF, 2024), which replaced RFC 4122. A UUID v4 contains 122 random bits; the remaining 6 bits encode the version (4) and variant (10xx in bits 64–65). This tool uses the browser's crypto.randomUUID() method (W3C Web Cryptography API), which provides cryptographically strong randomness from the operating system's CSPRNG, equivalent to /dev/urandom on Linux or BCryptGenRandom on Windows.

Standard: RFC 9562: Universally Unique IDentifiers (UUIDs)
Random bits: 122 bits (of 128 total; 6 bits encode version/variant)
Format: xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
Collision probability: ~50% at 2.7 × 10¹⁸ UUIDs generated

Related operations

For hashing identifiers into fixed-width values, try the hash generator. To produce strong random secrets, use the password generator. For encoding identifiers for transport, see Base64.

Frequently asked questions

How can I tell that a UUID is version 4?: Look at the 13th hex digit, the first digit of the third group: it is 4 in every v4 UUID. The 17th digit, the first of the fourth group, is 8, 9, a, or b, which marks the RFC 9562 variant.
Are the letters uppercase or lowercase?: The tool writes lowercase hex, as crypto.randomUUID() returns it. RFC 9562 treats the hex digits as case-insensitive when reading a UUID, so convert to uppercase if your system expects it.
Where does the randomness come from?: From crypto.randomUUID(), which draws on the operating system's cryptographically secure random number generator. Browsers without randomUUID use crypto.getRandomValues, which reads the same kind of source.
Is the UUID sent to a server?: All generation runs in your browser using crypto.randomUUID(). Our servers are not involved at any point.

Last reviewed September 30, 2026

Other pages for this tool

Related tools

Background reading: Complete guide to data tools