UUID Generator

A version 4 UUID is 122 random bits and six reserved ones. The reserved six are the reason every value here has a 4 starting the third group and an 8, 9, a or b starting the fourth: four bits declare the version, two declare the variant, and neither was ever meant to be random.

The randomness source is the whole question

These come from crypto.getRandomValues, the browser's CSPRNG. A generator built on Math.random produces values that look identical and collide under load, because the underlying generator is seeded predictably and has nothing like 122 bits of state. With a real CSPRNG a collision needs something on the order of a billion values a second for decades — so in practice a repeat means a broken random source, not bad luck.

An old UUID may be carrying more than you think

Paste one into the inspector and it reports the version, the variant, and — for v1, v6 and v7 — the timestamp encoded inside it. A v1 records when it was created and, historically, the MAC address of the machine that created it. An identifier treated as opaque is not necessarily opaque.

The nil UUID, all zeros, is a legal value meaning "no UUID" rather than a malformed one, and is reported as such. A v7 pasted into the inspector gives back its creation time to the millisecond, because that is literally the first 48 bits.