What a UUID actually is
A UUID (Universally Unique Identifier, also called a GUID — Globally Unique Identifier, Microsoft's name for the same format) is a 128-bit value, almost always written as 32 hexadecimal digits split into five groups by hyphens: 8-4-4-4-12, like f47ac10b-58cc-4372-a567-0e02b2c3d479. The point of a UUID is generating a unique identifier without any central coordination — no database auto-increment counter, no registry, no server round-trip to check "has this ID been used before." Two systems that have never communicated can each generate a UUID and, in practice, never produce the same one.
The version and variant bits, and why they matter
Not all 128 bits are random. A UUID encodes its own version number in 4 fixed bits (the first hex digit of the third group) and a "variant" in 2-3 fixed bits (the first hex digit of the fourth group), which is exactly what the validator on this page reads to tell you what kind of UUID you pasted in. The version says how the UUID was constructed — version 1 from a MAC address and timestamp, version 3 and 5 from hashing a name against a namespace (MD5 and SHA-1 respectively), version 4 from pure randomness, and versions 6-8 are newer variants standardized in 2024 (RFC 9562) for better database index locality. The variant field almost always reads "RFC 4122 / RFC 9562" in practice — the other variant values exist for historical compatibility with early Apollo NCS UUIDs and Microsoft's original GUID implementation, and essentially never show up in a UUID generated today.
Why version 4 is what nearly everyone actually uses
Versions 1, 3, and 5 all require some external input — a MAC address, a namespace UUID plus a name string — which makes them deterministic (the same input always produces the same UUID) but also more complex to generate correctly and, for version 1 specifically, a historical privacy concern since it embeds the generating machine's MAC address. Version 4 sidesteps all of that: generate 128 random bits, overwrite the 6 fixed version/variant bits, done. The generator on this page produces version 4 UUIDs using crypto.randomUUID(), a Web Crypto API method built into every modern browser that draws from the operating system's cryptographically secure random number generator — notMath.random(), which is not designed to be unpredictable and should never be used to generate identifiers that need to be hard to guess.
How unlikely a collision actually is
A version 4 UUID has 122 random bits (128 total, minus 4 fixed version bits and 2 fixed variant bits). Using the birthday-paradox bound — the same math behind "how many people need to be in a room before two share a birthday" — the number of random v4 UUIDs you'd need to generate before there's a 50% chance that any two of them collide is approximately 2.71 × 10¹⁸ (2.71 quintillion). Generating a billion UUIDs a second, that threshold would take roughly 86 years to reach. This is why "UUID collision" is treated as a non-issue in practical system design, even though it isn't mathematically impossible.
Nil, Max, and other special values
Two UUID values are explicitly reserved rather than randomly generated: the Nil UUID (00000000-0000-0000-0000-000000000000, all zero bits) conventionally means "no value" or "not set" in contexts expecting a UUID, and the Max UUID (ffffffff-ffff-ffff-ffff-ffffffffffff, all one bits) is its counterpart at the opposite end, standardized more recently as a sentinel for "greater than every possible UUID" in sorting and range-query contexts. Neither has a valid version nibble in the normal 1-8 range, which is exactly how the validator on this page recognizes and labels them specially rather than reporting a bogus version number.
Formatting conventions across languages and databases
The 8-4-4-4-12 hyphenated form is the most common representation, but far from the only one in practical use. Windows COM/GUID APIs frequently wrap it in curly braces ({f47ac10b-58cc-4372-a567-0e02b2c3d479}). URNs use a urn:uuid: prefix per RFC 4122's own specification. Some databases and binary storage formats strip the hyphens entirely to save 4 bytes of storage per UUID (32 hex characters instead of 36), reconstructing the standard punctuated form only when displaying it. This tool's format selector produces all four conventions from the same underlying value, and the validator accepts any of them as input — including case-insensitively, since some systems emit uppercase hex digits and others lowercase, with no difference in the underlying value either way.
Where UUIDs actually get used
Primary keys in distributed databases use UUIDs specifically to avoid the coordination problem a simple auto-incrementing integer creates once more than one server can insert rows independently — two database replicas can each generate UUIDs for new rows without ever needing to ask each other "what's the next available ID." Session tokens, request-tracing IDs (so a single request can be followed across multiple microservices in logs), file and object storage keys, and package/build identifiers all lean on the same property: generate it anywhere, no coordination required, collision risk low enough to ignore.