UUID & ULID Generator
A UUID and ULID generator. Produce cryptographically-random version-4 UUIDs or sortable ULIDs, one at a time or in bulk, with one-click copy. Explains when to reach for a random UUID versus a time-sortable ULID, and shows the structure of each. Uses the browser’s secure crypto — nothing is generated on or sent to a server.
122 random bits — unordered, reveals nothing. The default distributed ID.
3653e2de-97b0-410a-b93d-2a534629e9a6⧉a9f902db-2233-459c-85a0-095b926be0ad⧉b8e65f4f-ed63-4283-8f7c-68e8c923a58a⧉c4ac4ee1-e4ea-4623-9ff4-020f2a6e56f6⧉cba15c6d-a229-455e-9d85-1bc2f944628f⧉
Sometimes you need an ID that any machine can mint without asking anyone. That is the whole point of UUIDs and ULIDs: 128 bits of (mostly) randomness, unique enough that independent generators never realistically collide, so no central sequence or coordinator is required. It is what lets a client, an offline device, and three servers all create rows that will never clash.
A version-4 UUID is almost pure random — 122 random bits in the familiar 8-4-4-4-12 hex layout. It reveals nothing and imposes no order, which is exactly what you want for a public reference. The cost shows up when it becomes a database primary key: because consecutive inserts land at random points in the index, you get page splits and fragmentation.
A ULID fixes that by putting a 48-bit millisecond timestamp in the high bits and 80 random bits below, encoded in 26 sortable Crockford base32 characters. Now IDs created later sort after earlier ones as plain strings, so inserts stay local in the index and you get a free creation ordering — the same idea behind UUIDv7. The trade-off is that a ULID leaks its creation time. Pick random when you want opacity and no ordering; pick time-sortable when it is a key and locality matters. Either way, neither is a secret — for tokens, generate real high-entropy bytes instead.
How it works
- v4 UUIDs from the browser’s crypto (122 random bits).
- ULIDs: 48-bit ms timestamp + 80 random bits, Crockford base32.
- Single or bulk generation with one-click copy.
- Explains UUID (unordered) vs ULID (time-sortable) trade-offs.
Frequently asked questions
What is a version-4 UUID?
A UUID (Universally Unique Identifier) is a 128-bit value written as 32 hex digits in the 8-4-4-4-12 pattern. Version 4 fills almost all of those bits with random data (122 random bits, with 6 fixed for the version and variant), so two independently generated v4 UUIDs colliding is astronomically unlikely. That randomness is why v4 UUIDs can be generated anywhere — no central coordinator — which makes them the default for distributed IDs.
What is a ULID and how is it different?
A ULID (Universally Unique Lexicographically Sortable Identifier) is also 128 bits, but split into a 48-bit millisecond timestamp followed by 80 random bits, encoded as 26 Crockford base32 characters. The key difference: because the high bits are time, ULIDs generated later sort after earlier ones as plain strings. That makes them friendlier as database keys — inserts stay roughly in order instead of scattering across a B-tree the way random UUIDs do.
When should I use a UUID vs a ULID?
Use a random v4 UUID when you want no information leaked by the ID and don’t care about ordering — public identifiers, external references, or when a standard UUID column is expected. Prefer a ULID (or UUIDv7, which has the same time-ordered idea) when the ID is a primary key and insert locality matters: time-sortable keys reduce index fragmentation and page splits, and give you a free created-at ordering. The trade-off is that a ULID reveals its creation time.
Are these safe to use as secrets or tokens?
No. A UUID or ULID is an identifier, not a credential — it is meant to be unique, not unguessable in a security sense, and a ULID in particular exposes its timestamp and has structure. For session tokens, API keys or password-reset links, generate a dedicated high-entropy secret (e.g. 256 random bits from a CSPRNG) instead. These generators do use the browser’s cryptographically-secure RNG, so the randomness is sound — but the format is the wrong shape for a secret.