UUID Cheat Sheet

How a UUID is built, what each version contains, which one to use, and how to make one in your language.

Cheat sheetPrintableFree, no login

Updated 28 October 2026

Generate v4 or v7 UUIDs in bulk, or decode any UUID's version and timestamp.

UUID format

123e4567-e89b-42d3-a456-426614174000
xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx
               │    └─ variant: 8, 9, a or b for standard UUIDs
               └────── version: 1–8

A UUID is 128 bits, written as 32 hex digits in groups of 8-4-4-4-12 (36 characters with hyphens).
The 13th hex digit is the version. The 17th is the variant — 8, 9, a or b for RFC 9562 UUIDs.
Uppercase and lowercase mean the same thing. RFC 9562 recommends lowercase output.
GUID is Microsoft's name for the same thing, often written in braces: {123E4567-E89B-42D3-A456-426614174000}.

UUID versions

Version	Made from	Example	Use it for
`v1`	Timestamp + node (MAC)	`C232AB00-9414-11EC-B3C8-9F6BDECED846`	Legacy. Leaks creation time and can leak the MAC address	Try ↗
`v3`	MD5 hash of namespace + name	`5df41881-3aed-3515-88a7-2f4a814cf09e`	Same name always gives the same UUID. Prefer v5	Try ↗
`v4`	122 random bits	`919108f7-52d1-4320-9bac-f847db4148a8`	General purpose. The most common version	Try ↗
`v5`	SHA-1 hash of namespace + name	`2ed6657d-e927-568b-95e1-2665a8aea6a2`	Deterministic IDs, e.g. one ID per URL or email	Try ↗
`v6`	v1 reordered so it sorts by time	`1EC9414C-232A-6B00-B3C8-9F6BDECED846`	Only when migrating from v1; otherwise use v7	Try ↗
`v7`	Unix milliseconds + random	`017F22E2-79B0-7CC3-98C4-DC0C0C07398F`	Database keys — sorts by creation time	Try ↗
`v8`	Custom layout	`2489E9AD-2EE2-8E00-8EC9-32D5F69181C0`	Your own format inside the UUID shape	Try ↗

The v3 and v5 examples are the UUIDs for the name www.example.com in the DNS namespace. Version 2 (DCE security) is reserved and almost never used. Try ↗ decodes the example in the UUID checker, including the creation time inside v1, v6 and v7.

Special UUIDs

Name	Value	Meaning
Nil UUID	`00000000-0000-0000-0000-000000000000`	"No UUID" — an empty value
Max UUID	`ffffffff-ffff-ffff-ffff-ffffffffffff`	Upper bound, e.g. for ranges
DNS namespace	`6ba7b810-9dad-11d1-80b4-00c04fd430c8`	For v3 and v5 names that are domain names
URL namespace	`6ba7b811-9dad-11d1-80b4-00c04fd430c8`	For v3 and v5 names that are URLs

Which version should I use?

Database primary keys: v7. New rows land at the end of the index instead of random places, which keeps inserts fast.
Everything else that needs a unique, unguessable ID: v4.
The same input must always give the same ID: v5 with a namespace UUID.
Don't use v1 in new systems — it reveals when and possibly where the UUID was made.
UUIDs are not secrets. v4 is hard to guess, but for session tokens or password-reset links use a dedicated random token.

Generate UUIDs in code

Language	Random (v4)	Time-ordered (v7)
JavaScript	`crypto.randomUUID()`	`v7()` from the `uuid` npm package
Python	`uuid.uuid4()`	`uuid.uuid7()` (Python 3.14+)
Java	`UUID.randomUUID()`	a library such as `uuid-creator`
C# (.NET)	`Guid.NewGuid()`	`Guid.CreateVersion7()` (.NET 9+)
Go	`uuid.New()` (google/uuid)	`uuid.NewV7()` (google/uuid)
PostgreSQL	`gen_random_uuid()`	`uuidv7()` (PostgreSQL 18+)
MySQL	`UUID()` gives v1, not v4	—
Command line	`uuidgen`	—

Store UUIDs in a native uuid column or as 16 bytes (BINARY(16)), not as 36-character text.

Frequently asked questions

Can two UUIDs be the same?

In theory yes, in practice no. A v4 UUID has 122 random bits: you would need about 2.7 × 10¹⁸ UUIDs for a 50% chance of a single duplicate.

What is the difference between a UUID and a GUID?

Nothing meaningful — GUID is Microsoft's name for a UUID. GUIDs are often shown in uppercase inside braces, and Windows stores the first three groups in a different byte order in binary form.

Which UUID version should I use?

v4 for general unique IDs, v7 for database keys because it sorts by creation time, and v5 when the same input must always produce the same ID.

Is a UUID secure enough for a password-reset token?

A v4 UUID from a good random source is hard to guess, but it's better to use a purpose-made random token with at least 128 bits and an expiry. Never use v1 or v7 for secrets — part of them is a timestamp.

How long is a UUID?

128 bits: 32 hex digits, or 36 characters with the four hyphens.