UUID generator · Guide
UUID Generator v4: Random Identifiers and How They Are Built
UUID v4 is 122 bits of randomness with 6 bits reserved to say what it is. That simplicity is why it became the default identifier for distributed systems — no coordination, no central authority, no shared state.
How the bits are arranged
128 bits total. Six are fixed: four for the version (0100 = v4) and two for the variant (10 = RFC 9562). The remaining 122 come from a cryptographically secure random source.
In the printed form xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx, the 4 is the version nibble and y is one of 8, 9, a or b. Those two positions are how you identify a v4 by eye:
36b8f84d-df4e-4d49-b662-bcde71a8764f
^ ^
| variant (8, 9, a or b)
version 4Generating one
Use the platform function. It reads the OS entropy source and sets the version and variant bits correctly:
crypto.randomUUID() // JS, secure contexts and Node 19+
uuid.uuid4() # Python
(string) Str::uuid() // PHP, Laravel
UUID.randomUUID() // Java
Guid.NewGuid() // C#
uuidgen # shellNever build one from Math.random() or a language rand(). Those are predictable, and a UUID used as a token, invitation link or reset key then becomes guessable.
Collisions
With 122 random bits, you would need to generate about 2.7 × 10^18 UUIDs before reaching a 50% chance of any collision. At a million per second that is roughly 85,000 years.
The realistic risk is not the maths but a bad random source — a virtual machine cloned with the same entropy pool, or an embedded device with no entropy at boot. Collisions in the wild come from broken generators, never from probability.
When v4 is the wrong choice
As a database primary key at scale, random UUIDs scatter inserts across the index and hurt write performance and cache locality. UUID v7 puts a timestamp first and fixes exactly that.
v4 remains right when the identifier is public and creation time should stay private — v7 leaks it. Choose deliberately rather than defaulting.
Frequently asked questions
How random is a UUID v4?
122 of its 128 bits are random; the other 6 encode version and variant.
Can two v4 UUIDs collide?
Not in practice with a proper random source. Real collisions come from broken generators.
Is UUID v4 secure enough for a token?
Only if generated from a cryptographic source. Even then, a purpose-built token is clearer about intent.
Ready to try it?
Open the free browser-based UUID generator and apply what you just read — no sign-up, runs locally.
Open the UUID generator tool