Hashes/Crypto

UUID Generator

Generate UUID versions 1, 3, 4, 5, 6 and 7 — random, time-based, and name-based.

A UUID (Universally Unique Identifier) is a 128-bit identifier that's unique in practice without a central registry: two independent servers can generate one at the same moment and almost never collide. The versions differ in how they're generated.

Which version to pick

Common uses

Things to keep in mind

UUID v1 and v6 embed the generating device's MAC address — avoid them if that's an unwanted disclosure.

The format is 32 hexadecimal characters grouped with hyphens as 8-4-4-4-12 (e.g. 550e8400-e29b-41d4-a716-446655440000).

Article about this tool: UUID: how identifiers that almost never repeat are generated

Frequently asked questions

What's the difference between UUID v4 and other versions?

UUID v4 is generated from random or pseudo-random numbers, making it the simplest choice with no dependency on time or hardware identifiers. Other versions like v1 encode a timestamp and MAC address, or v5 derive a UUID deterministically from a namespace and name.

How likely is it that two generated UUIDs collide?

Extremely unlikely. A v4 UUID has 122 random bits, so you'd need to generate billions of UUIDs per second for centuries before a collision became statistically probable.

Are the UUIDs generated here sent anywhere?

No. Generation happens entirely in your browser using a cryptographically secure random source — nothing is sent to a server.

What is UUID v7 and why is it better than v4 for databases?

UUID v7 embeds a timestamp in the leading bits, so values sort naturally by creation time — unlike a fully random v4, which hurts database index performance due to the chaotic insert order of new rows.

Can I use a UUID as a secret token?

For UUID v4 — yes, since it's generated by a cryptographically secure random source. But UUID v1 partially reveals the creation time and the device's MAC address, so it's unsuitable where unpredictability is required.

Articles: Hashes/Crypto

Hash Generator: how MD5, SHA-1, and SHA-256 differ from each other

Why MD5 is still used to verify file integrity, but not for passwords.

Checksum Verifier: how to check that a file isn't corrupted

Why a matching checksum confirms a file's integrity, but not who created it.

HMAC: how a keyed hash differs from a regular hash

Why a plain SHA-256 doesn't protect against message tampering, but HMAC does.

Bcrypt: why passwords are hashed slowly, not quickly

Why fast SHA-256 is a bad choice for passwords, and slow bcrypt is the right one.

Password Generator: what actually makes a password strong

Why a long dictionary-word password is stronger than a short one with symbols and digits.

AES: how symmetric encryption works

Why the same key both encrypts and decrypts data in AES, and how that differs from asymmetric encryption.

Argon2: why this algorithm won the password hashing competition

How Argon2 defends better against GPU-based attacks than older password hashing algorithms.

Scrypt: why the algorithm needs so much memory

Why scrypt deliberately demands a lot of memory to make cracking on ASIC devices harder.

TOTP: how one-time codes in authenticator apps work

Why the code in Google Authenticator works offline and syncs with the server only via time.

PBKDF2: the oldest key-stretching standard

Why the recommended PBKDF2 iteration count keeps growing every year.

X.509: what's inside an SSL certificate

What exactly the browser checks in a site's certificate before showing the green padlock.

PGP: how public-key and private-key encryption works

Why you can freely share a PGP public key but never the private one.