UUID Generator & Inspector (v4 / v1)

A UUID (Universally Unique Identifier, also called a GUID on Windows) is a 128-bit value written as five hyphen-separated hex groups. This tool does both jobs you actually need: it generates UUIDs — version 4 by default, or time-based version 1 — in bulk using crypto.getRandomValues, and it inspects any UUID you paste to reveal how it was made.

Generating. Version 4 UUIDs are filled with 122 bits of cryptographically-secure randomness, then stamped with the version and variant bits — the correct choice whenever an identifier must be unguessable. Version 1 is time-based; this generator uses the current timestamp with a randomised node (with the multicast bit set, as RFC 4122 permits) so it never leaks a real MAC address. Everything is generated locally in your browser and never transmitted, so the values are safe to use as real secrets.

Inspecting. Not all UUIDs are equal, and the version nibble and variant bits tell you how a value was generated — which has security consequences. Paste a UUID to read its version and variant; for a version 1 UUID the tool recovers the embedded creation timestamp and node, and for a nil or max UUID it says so.

What the versions mean. v4 is random. v1 embeds a 60-bit timestamp and, in the wild, often the generating machine's MAC address. v3 and v5 are deterministic hashes of a namespace plus a name (MD5 and SHA-1). The newer v7 embeds a Unix millisecond timestamp and sorts naturally.

Security relevance. If an application uses UUIDs as security tokens — password-reset links, session IDs, unguessable object references — it must use version 4 or another CSPRNG-backed scheme. Version 1 and version 7 are predictable in their time component, and a real-world v1 leaks the host MAC and can collide if the clock is set back, so an attacker who observes a few tokens can dramatically narrow the search space. Deterministic v3/v5 UUIDs are guessable by anyone who knows the input.

Defensive angle. Audit where your system uses UUIDs as capabilities. Anything an attacker should not guess must be v4 (or 128 bits straight from crypto) — for human-facing secrets like reset links, the password generator produces equivalent unguessable strings — delivered over TLS, expiring, and single-use. Reserve v1/v7 for database keys where sortability matters and predictability does not; when you inspect a v1 UUID here, the timestamp converter puts its embedded creation time in context alongside your other log timestamps.