Contact

Tools  /  Security  /  UUID Validator

SECURITY

UUID Validator

Validate one or many UUIDs with a specific reason for any failure, full version/variant/timestamp decode, and an equality checker.

More Security tools

Basic Auth Generator Bearer Token Builder Password Strength Checker Passphrase Generator Certificate / DER Structure Viewer PEM Formatter

What this tool does

Checks whether one or more UUIDs are genuinely well-formed, and if one isn't, says specifically why -- wrong length, a hyphen in the wrong place, an invalid version nibble, or variant bits that don't match RFC 9562/4122 -- rather than a bare valid/invalid verdict. Every valid UUID also gets decoded: its version and what it means, its variant, the exact embedded timestamp for version 1, 6 and 7, and alternate representations -- plain hex (no hyphens), Base64, a 128-bit integer, and a byte array.

The v1/v6 privacy concern

Version 1 and 6 UUIDs embed the generating machine's node ID and the exact creation timestamp. This tool checks the node field's multicast bit and tells you whether it looks like a real hardware MAC address or a randomly generated stand-in -- either way, exposing a v1/v6 UUID to an untrusted party can leak when and (sometimes) from which machine it was created, a well-documented fingerprinting concern that's a real reason to prefer v4 or v7 for anything user-facing.

Batch validation and duplicate detection

Paste several UUIDs, one per line — a database export, a log file, a CSV column — and each is checked and decoded independently, so you can spot the one malformed row in a list of thousands without checking them by hand. Any UUID that appears more than once in the list (after normalizing format and case) is flagged as a duplicate, useful for catching an accidental copy-paste or a genuine collision in generated data. Results export as a single text file.

Accepted formats, examples, and history

Input is normalized before validation, so a UUID with braces ({550e8400-...}), a urn:uuid: prefix, no hyphens at all, or any mix of upper/lowercase all validate the same way a plain hyphenated UUID would. One-click example chips insert a correctly structured sample of each version (v1 through v8, plus NIL and MAX) so you can see how each decodes without needing a real one on hand. A session-only history keeps the last 8 UUIDs validated, and any valid result can be shown as a QR code for moving it to another device.

Comparing two UUIDs

Two UUID strings can represent the exact same identifier while looking different on the page — one uppercase, one with braces, one missing hyphens. The equality checker normalizes both before comparing, so you get a straight yes/no on whether they're actually the same UUID, not a string-literal diff that would wrongly say they don't match.

Privacy

Everything runs locally in your browser. The session history lives only in this tab's memory -- never written to localStorage or sent anywhere. Nothing is uploaded.

FAQ

Frequently asked questions

Is my UUID uploaded anywhere?
No. Validation, decoding, comparison and QR generation all run entirely in your browser -- nothing is sent to a server. The session history lives only in this tab's memory.
Why does it say my UUID is invalid when it looks fine?
The tool checks the actual structure, not just the length -- a UUID's 13th hex digit must be its version (1-8 for the versions currently defined) and the first digit of the 17th position must be 8, 9, a or b for the standard RFC 4122/9562 variant. A UUID that's merely 32 hex characters in the right grouping but fails either of those checks gets a specific reason, not just "invalid".
Can it read the creation time out of a UUID?
Yes, for version 1, 6 and 7 -- these versions embed a real timestamp. Version 4 (the most common, random) and version 5/3 (name-based, hashed) don't carry a recoverable timestamp at all, by design.
Why does it warn about privacy for some UUIDs?
Version 1 and 6 UUIDs embed the generating machine's node ID and exact creation time. The tool checks whether that node ID's multicast bit is set (a randomly generated stand-in) or not (possibly a real MAC address) and flags the general fingerprinting concern either way -- prefer v4 or v7 for anything exposed to users or third parties.
Does it detect duplicate UUIDs in a batch?
Yes -- after normalizing format and case, any UUID that appears more than once in the pasted list is flagged, both with a summary count and individually on each repeated entry.
What alternate representations does it show?
Plain hex with no hyphens, Base64 of the 16 raw bytes, the UUID as a 128-bit integer, and a byte array -- useful when working with code or systems that store a UUID in one of these forms instead of the standard hyphenated string.
Does it accept UUIDs with braces or a urn:uuid: prefix?
Yes -- braces, a urn:uuid: prefix, missing hyphens, and any mix of upper/lowercase are all normalized before validation, since all of these are legitimate ways UUIDs appear in real systems and code.
Can I check whether two UUIDs are actually the same?
Yes -- the equality checker normalizes both (case, hyphens, braces) before comparing, so two UUIDs that look different on the page but represent the same identifier are correctly reported as equal.
Can I validate a whole list of UUIDs at once?
Yes -- paste one UUID per line and each is validated and decoded independently in its own result block, with a single button to download every result as a text file.
Theme Accent