UUID Generator Tips: Which Version to Pick and the Mistakes That Bite
Reviewed by the FreeOnline.fyi team · Updated 2026-09-11
When we first built the UUID generator on FreeOnline.fyi, we made every mistake
When we first built the UUID generator on FreeOnline.fyi, we made every mistake the RFC warns about — generating test fixtures with v1 because "they look more random," then wondering why our pagination broke. Below are the practical lessons we learned while stress-testing the tool with real database schemas and API specs.
The first decision is which UUID version to pick, and the answer is almost always v4. v4 IDs are 122 bits of randomness, giving roughly 5.3 × 10³⁶ unique values — collision odds so low you can ignore them for any realistic dataset. v1 IDs embed a timestamp and the host's MAC address, which sounds useful until you realize they leak information: anyone who knows the version can extract when and, often, where the record was created. That makes them a poor default for user-facing identifiers. We still expose v1 in the UUID generator because legacy systems sometimes demand them, but treat it as a compatibility option, not a recommendation.
v5 is the version most beginners skip, and it is the one worth understanding.
v5 is the version most beginners skip, and it is the one worth understanding. A v5 UUID is deterministic — the same namespace UUID plus the same name always produces the same output. That makes it ideal when you need stable IDs across systems: hashing "[email protected]" inside the DNS namespace gives you the same UUID on every machine, every time, with no coordination needed. When you generate v5 in our tool, the resolved namespace UUID is shown beside the result so you can audit exactly which base was used — a small detail that has saved us from debugging cross-service mismatches more than once.
Formatting looks trivial until your parser rejects a payload. The canonical RFC 4122 form is lowercase with hyphens, like 550e8400-e29b-41d4-a716-446655440000. Toggle hyphens off and the same ID becomes a 32-character hex string; toggle uppercase on and some databases will treat it as a different value than the lowercase version. The live format preview in the generator shows exactly what will be produced before you click, so you can match the casing the consumer expects without generating, copying, and re-running. If you are embedding IDs in Microsoft Word documents or PDF metadata — a common need we see from users of our PDF to Word Converter (Free, No Registration) — the curly-brace toggle gives you the {…} form some document-ID systems prefer.
For bulk generation, the practical floor is 1 and the ceiling is 500 per click —
For bulk generation, the practical floor is 1 and the ceiling is 500 per click — enough to seed a test database in one pass without crashing the browser tab. A few habits we picked up: never paste raw UUIDs into a SQL INSERT without wrapping them in quotes (Postgres accepts them unquoted in some contexts but MySQL does not); use the bulk textarea's "Download .txt" option rather than copying 500 IDs to the clipboard, which truncates silently past a certain length in some browsers; and if you need comma-separated output for a JSON array, post-process in your editor rather than adding a UI option that would clutter the main flow.
The most expensive mistakes with UUIDs are not about generation — they are about assumptions. Do not treat a UUID as a secret or as a capability token: v4 IDs are guessable only by brute force, but a logged URL containing one is effectively public. Do not rely on UUID string ordering to mean chronological order: v4 IDs are random and will sort lexically, not temporally; v1 IDs sort by time but only at second granularity on the same node. If you need time-ordered IDs, look at ULID or UUIDv7, which we may add to the generator once RFC 9562 sees wider adoption.
Finally, a trust note: the generator runs entirely in your browser — no IDs are
Finally, a trust note: the generator runs entirely in your browser — no IDs are sent to a server — which matters when you are seeding identifiers for a production migration or generating tokens you intend to publish. Verify any UUID that becomes a security-relevant identifier against your own entropy source, and consult RFC 4122 directly if you are implementing your own generator. For everyday database keys, test fixtures, and cross-service resource IDs, the UUID generator is the fastest way we know to get a compliant string without leaving the keyboard.