UUID Validator

How the UUID Validator works

UUID validator: what valid means

A UUID is 128 bits, written as 32 hexadecimal digits in five hyphenated groups of 8, 4, 4, 4 and 12. That is the whole syntax, and it is easy to get wrong in the ways this tool reports: a digit dropped when copying, a letter outside 0–9 a–f, hyphens in the wrong places after a bad string join, or a stray { from a Microsoft registry export. Anything that is not 32 hex digits is invalid, full stop.

Version and variant are inside the value. The first digit of the third group is the version. The first digit of the fourth group encodes the variant: 8, 9, a or b means an RFC 4122 (now RFC 9562) UUID, which is what every modern library produces. Values 0–7 there are the old Apollo NCS layout, c–d are reserved for Microsoft's legacy GUIDs, and e–f are held back for the future. A UUID with a non-RFC variant is still 128 valid bits, so it is reported as valid, but with a note that the version digit does not mean anything for it.

What the versions are. Version 4 is random: 122 bits of entropy, no information inside, the default choice for a decade. Version 7 is the modern replacement for database keys: the first 48 bits are a Unix millisecond timestamp so the values sort in creation order, which keeps index pages tidy. Version 1 is the original time-based form, with a 100-nanosecond timestamp counted from 1582 scattered across the first three groups and the generating machine's MAC address in the last group — which is why it is out of favour: it leaks the hardware address and the exact time. Version 6 is version 1 with the timestamp bits reordered so they sort. Versions 3 and 5 hash a name into a UUID with MD5 or SHA-1, version 2 is a rarely seen DCE security variant, and version 8 is reserved for custom layouts.

Timestamps are decoded. For v7 the tool reads the leading 48 bits as milliseconds and shows the UTC time. For v1 and v6 it reassembles the 60-bit timestamp, converts from the Gregorian epoch of 15 October 1582, and shows the time; for v1 it also shows the node field formatted as a MAC address. A v1 UUID from a real system will therefore tell you when and roughly where it was made, which is a useful audit fact and a useful privacy warning.

Special values. The nil UUID, all zeros, and the max UUID, all ones, are both defined by the standard and reported by name rather than as version 0 or version 15.

Forms that are accepted. Lower-case hyphenated is canonical. Upper-case is valid and common in .NET and SQL Server output, and is noted. No hyphens at all is how some databases store the value in a CHAR(32), and is noted. Braces {…} are the Microsoft GUID string form. urn:uuid: is the URN form used in XML and some APIs. Each of these wrappers is stripped, the core is validated, and the note tells you what form it arrived in so a mixed list can be normalised.

Related tools