UUID Generator and Reference: v1, v4, v7 Explained for QA and Devs
A practical guide to UUIDs — what they are, when to use v1, v4, or v7, how to generate them in every language, and how to keep canonical test UUIDs handy for your team.
· 8 min read
UUIDs (universally unique identifiers, also called GUIDs) are 128-bit values you can generate independently and trust to never collide. Almost every modern system uses them somewhere — and almost every QA engineer eventually needs to know which version to use, how to generate one, and how to keep a few canonical test UUIDs handy.
Generate a UUID right now
Modern browsers and Node.js (16.7+) ship `crypto.randomUUID()` — a single call returns a v4 UUID. In the browser console: `crypto.randomUUID()` returns something like `f47ac10b-58cc-4372-a567-0e02b2c3d479`. No library needed.
On the command line: `uuidgen` (macOS, most Linux), `[guid]::NewGuid()` (PowerShell), or `python -c "import uuid; print(uuid.uuid4())"`. In Postgres: `gen_random_uuid()` (built in since 13). In MySQL 8+: `UUID()`.
Which version should you use?
v4 (random) is the default for almost everything: distributed IDs, primary keys when you do not care about insertion order, session tokens. 122 bits of randomness — collision is mathematically negligible.
v1 (timestamp + MAC) leaks the host's MAC address and creation time. Avoid for anything user-facing or security-sensitive.
v7 (timestamp + random, RFC 9562) is the new standard for database primary keys. It is sortable by creation time, which gives v4-like uniqueness with v1-like insert performance — without the MAC leak. Postgres 18+ ships `uuidv7()` natively; for older versions use a library.
v3 and v5 are namespace-based (deterministic): hash the same input twice, get the same UUID. Useful for content-addressed IDs, rare otherwise.
UUID format and structure
The canonical string is 36 characters: 32 hex digits plus 4 hyphens, in the pattern `xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx`. The `M` digit is the version (1, 3, 4, 5, 7), and the top bits of `N` are the variant (almost always `8`, `9`, `a`, or `b`). You can spot a v4 UUID at a glance by the 4 in position 15.
Storage: 16 bytes binary, or 36 chars as text, or 32 chars stripped of hyphens. Postgres has a native `uuid` type that stores binary and presents text; use it instead of `varchar(36)`.
Common test UUIDs to keep handy
The all-zeros nil UUID `00000000-0000-0000-0000-000000000000` is reserved by RFC 9562 and is the universal 'no UUID' sentinel. The all-ones max UUID `ffffffff-ffff-ffff-ffff-ffffffffffff` is also reserved. Your QA team probably needs a handful of stable test UUIDs for fixtures — keep them in a shared catalog so the same `f47ac10b-...` always means the same test user across environments.
Validate a UUID
The standard regex: `^[0-9a-f]{8}-[0-9a-f]{4}-[1-7][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$` (case-insensitive). It accepts v1 through v7. Most languages also ship a `UUID.fromString()` that throws on invalid input — prefer it over hand-rolled regex.
Generate UUIDs in every language
JavaScript/TypeScript: `crypto.randomUUID()`. Python: `import uuid; uuid.uuid4()`. Java: `java.util.UUID.randomUUID()`. Go: `github.com/google/uuid` then `uuid.NewString()`. Ruby: `require 'securerandom'; SecureRandom.uuid`. Rust: `uuid::Uuid::new_v4()`. C#: `Guid.NewGuid()`. PHP: `Ramsey\Uuid\Uuid::uuid4()`. Bash: `uuidgen`. SQL (Postgres): `gen_random_uuid()`. SQL (MySQL): `UUID()`.
Keep your test UUIDs one paste away
QA workflows often need the same canonical UUIDs over and over — a known-good test customer ID, a fixed admin user ID, a sentinel 'deleted' record. Keep them in a TestAssets list grouped by environment and paste them into any input from the browser, desktop, or mobile autofill instead of regenerating each time.