UUID Validator

UUID validation, version by version

A UUID (Universally Unique Identifier) is a 128-bit value typically written as 32 hexadecimal digits in the 8-4-4-4-12 pattern — for example f47ac10b-58cc-4372-a567-0e02b2c3d479 (36 characters with hyphens). The canonical reference was RFC 4122 (2005); it was replaced and extended by RFC 9562 in 2024, which added versions 6, 7 and 8 without breaking the older ones.

Structural validation is straightforward: a single regex catches the digit pattern, the version nibble and the variant bits. The hard part is choosing the right version for the job.

/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i

The third group starts with 1–8 — that nibble is the version. The fourth group must start with 8, 9, a or b — those are the two high variant bits (10x in binary) that mark an RFC 4122 / 9562 UUID. Strings that pass the digit shape but fail these two positions are invalid even if they look right.

The eight versions

• v1 — 60-bit timestamp + 48-bit MAC address. Sortable but leaks the host's MAC and creation time.
• v3 — MD5 hash of a namespace UUID plus a name. Deterministic: same input always yields the same UUID.
• v4 — 122 bits of pure randomness. The most common version, but completely unsortable, which causes B-tree index fragmentation.
• v5 — same idea as v3 but with SHA-1 instead of MD5. Preferred over v3.
• v6 — v1 with the timestamp fields reordered so the UUID sorts lexicographically by time.
• v7 — 48-bit Unix millisecond timestamp + 74 bits of randomness. Modern recommendation: sortable, no MAC leak, indexes well.
• v8 — fully custom layout, escape hatch for apps that need their own encoding while staying RFC-compliant.

Special values and edge cases

The nil UUID 00000000-0000-0000-0000-000000000000 is reserved by the spec to mean "no value" — it is technically valid syntactically but does not encode any version, so most validators flag it specially. The max UUID ffffffff-ffff-ffff-ffff-ffffffffffff was standardized by RFC 9562 for the same role. UUIDs are case-insensitive but the spec recommends lowercase; some legacy systems (Microsoft GUIDs in registry, JSON Web Tokens with jti) emit uppercase. A few implementations also accept the hyphenless form (32 contiguous hex digits) but the canonical shape always includes the four hyphens.

Storage, indexing and libraries

Postgres has a native uuid column type (16 bytes binary) plus the uuid-ossp and pgcrypto extensions for generation. MySQL stores UUIDs as BINARY(16) — text is wasteful. MongoDB's ObjectId is only 12 bytes but is not a UUID. In Node, the uuid npm package is canonical; in modern browsers crypto.randomUUID() generates a v4 directly without any dependency.

FAQ

v4 or v7 for new projects? v7 in almost every case. It keeps the no-coordination property of v4, sorts by creation time so it indexes well in B-trees, and the millisecond prefix lets you order events without a separate created_at column.

Is the nil UUID valid? Syntactically yes, semantically it means "absent" — treat it the same as NULL in your domain.

Does v1 really leak my MAC address? Yes. The last 48 bits are the host's network card MAC plus the creation timestamp. This is why v1 is not recommended for public-facing IDs — it lets an attacker correlate UUIDs generated on the same machine.

Can a UUID collide? Mathematically yes, practically no. For v4, you would need to generate 2.71 quintillion UUIDs before the chance of a single collision reaches 50% (the birthday bound). At one million UUIDs per second it would take 85 years.