UUID Validator

What this tool is used for

• Checking whether a string is a well-formed UUID before using it as a key.
• Detecting which UUID version a value is, which decides what it can tell you.
• Decoding a version 1 UUID's embedded timestamp.
• Validating a batch of identifiers before an import.
• Distinguishing a malformed UUID from an unknown one.

Frequently Asked Questions

Is the Nil UUID actually valid?

Yes. RFC 9562 §5.9 defines the all-zero Nil UUID and §5.10 the all-f Max UUID; both are valid strings that simply carry no version or variant. Insisting on a version nibble of 1–8 rejects them — and rejects every Microsoft-variant GUID too, since those use a variant nibble of c or d.

What do the version and variant nibbles mean?

The 13th hex digit is the version. The 17th encodes the variant in its leading bits: 0xxx is the legacy NCS layout, 10xx is the RFC's own, 110x is Microsoft's, and 111x is reserved. That is why a canonical UUID's fourth group always begins with 8, 9, a or b.

Where does the v1 timestamp come from?

From 60 bits spread across the first three groups, counted in 100-nanosecond ticks since 15 October 1582, the date the Gregorian calendar began. Subtracting 122192928000000000 ticks rebases it to the Unix epoch. The v1 sample here decodes to 4 February 1998, when RFC 4122's namespace UUIDs were minted.

Are v7 timestamps decoded too?

Not currently — only v1. v7 stores plain Unix milliseconds in its first 48 bits, which is exactly what makes it sortable by creation time and why it has largely displaced v1 for database keys. Its version and variant are still reported here, just not its time.

Which formats are accepted?

The canonical hyphenated form and the urn:uuid: prefixed form, case-insensitively. The brace-wrapped Microsoft registry form and the unhyphenated 32-digit form are not — strip the braces or restore the hyphens first. The Generate button uses Math.random for samples; real identifiers need crypto.randomUUID().

Common errors and gotchas

• Treating validity as existence, since a well-formed UUID need not refer to anything.
• Rejecting a UUID because of case, when the format is case-insensitive.
• Accepting a UUID without hyphens in a system that stores them with, which then fails comparison.
• Reading a version 1 timestamp as trustworthy, since it comes from the generating machine's clock.
• Assuming version 4 is unguessable enough to act as authorisation.