UUID Inspector

How to use UUID Inspector

1. Paste the UUID.
2. Read its version, variant and, where present, the embedded timestamp.
3. Note whether it conforms — the version and variant digits decide it.
4. The 13th hex digit is the version; the 17th is the variant and should be 8, 9, a or b.
5. Version 1 embeds a MAC address and creation time — treat it as disclosing both.
6. Parsing happens in your browser; identifiers are not transmitted.

Reading the version and variant by eye

The 13th hexadecimal digit is the version and the 17th is the variant. So in xxxxxxxx-xxxx-4xxx-8xxx-xxxxxxxxxxxx, the 4 says version 4 (random) and the 8 says the standard RFC variant — that position is always 8, 9, a or b for a conforming UUID. Once you know where to look you can identify a UUID’s version from a glance at the string, without any tool.

What each version encodes, and what it leaks

Version 1 embeds a 60-bit timestamp and the generating machine’s MAC address, which makes it sortable and makes it disclose where and when it was created — a genuine privacy consideration, and famously how the Melissa virus author was traced. Version 3 and 5 are deterministic hashes of a namespace and a name, so the same input always gives the same UUID. Version 4 is 122 random bits and reveals nothing. Version 7, standardised in 2024, puts a millisecond timestamp in the high bits with the rest random — sortable like v1 without the MAC address.

Why version matters for database keys

Random v4 keys scatter inserts across a B-tree index, which fragments it and hurts write throughput and cache locality on large tables. Time-ordered keys append instead, which is why v7 exists and why people previously invented ULIDs and similar schemes. If a table is small the difference is invisible; at tens of millions of rows it is measurable, and changing key format later is painful.

When a UUID is not a UUID

Plenty of things that look like UUIDs are not conforming ones — a random 32-hex string formatted with hyphens will fail the version and variant check, even though it works fine as an identifier. That matters when a library validates strictly and rejects an id that your system generated happily for years. Checking the version and variant digits is the quickest way to tell whether an identifier will survive strict parsing.