UUID Generator
Generate random version 4 UUIDs (GUIDs) online — plus cryptographic hex and Base64 secrets (the openssl rand equivalent) and random strings. Free, and everything happens right in your browser.
Version 4 (random) UUID per RFC 4122 — format xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx, 122 random bits. The same format as a GUID in .NET and Windows.
32 bytes (64 hex characters) is the standard for API secrets, session keys, and JWT/HMAC-SHA256 secrets.
An alphanumeric string works well as an API key, a URL token, or a coupon code.
Terminal equivalent
uuidgen🔒 Keys are generated with a cryptographically secure generator (Web Crypto API) right in your browser. They are never sent anywhere, never stored, and no one but you ever sees them.
UUIDs and secrets without a terminal
UUID v4 & GUID • Hex and Base64 keys • Nothing leaves your browser
What a UUID is, and where you use one
A UUID (Universally Unique Identifier) is a 128-bit identifier written as xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx. Version 4 is generated from random data — 122 random bits — which makes a collision between two UUIDs practically impossible. That's why it's the default choice for database primary keys, file names, request IDs, and transaction identifiers. GUID is the same thing under Microsoft's name: a UUID v4 from this page works anywhere .NET or Windows asks for a GUID.
Why almost every app needs secrets too
Besides identifiers, nearly every application needs secrets: a key for signing session cookies, a JWT secret, API keys, hashing salts, encryption keys, or values for a .env file. The common rule — a secret must come from a cryptographically secure generator (CSPRNG), not from a keyboard. Made-up strings like mysecretkey123 are the first thing attackers try. The Hex and Base64 tabs above give you exactly that kind of secret, at any standard length.
The same keys you'd get from a terminal
This generator is the browser equivalent of the usual commands — for when openssl isn't at hand (on Windows, say, where it's missing by default):
| Command | Output |
|---|---|
uuidgen (Linux/Mac) | UUID v4 |
[guid]::NewGuid() (PowerShell) | GUID / UUID v4 |
openssl rand -hex 32 | 32 bytes as 64 hex characters |
openssl rand -base64 32 | 32 bytes in Base64 |
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))" | 32 bytes as hex in Node.js |
python -c "import secrets; print(secrets.token_hex(32))" | 32 bytes as hex in Python |
On Windows, openssl comes with Git Bash (Git for Windows) — you won't find it in plain CMD or PowerShell. If you need a key just once, generate it here with one click — the browser's crypto.getRandomValues is an equally secure source of randomness, and nothing ever leaves your machine.
How long should a key be?
For most uses the standard is 32 bytes (256 bits) — session keys, JWT/HMAC-SHA256 secrets, API secrets, and AES-256 keys. A shorter 16 bytes (128 bits) is enough for identifiers and short-lived tokens; pick 48–64 bytes for HMAC-SHA384/512. A longer key never hurts — it's just clumsier to pass around.
UUID and key FAQ
UUID vs. GUID, key lengths, Base64url, and replacing openssl on Windows.
What is a UUID, and what is it used for?
A UUID (Universally Unique Identifier) is a 128-bit identifier in the form xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx. Version 4 is generated randomly and is used as a unique ID for database records, files, transactions, and requests — a collision between two random UUIDs is practically impossible.
What is the difference between a UUID and a GUID?
Nothing substantial — GUID (Globally Unique Identifier) is simply the name Microsoft uses for UUIDs in .NET and Windows. The format and generation are identical, so a UUID v4 from this generator works anywhere a GUID is required.
How do I replace openssl rand -hex 32 on Windows?
The openssl command isn't available on Windows by default — though it ships with Git Bash (Git for Windows), where openssl rand -hex 32 works out of the box. Another option is Node.js: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))". The fastest route is this generator — pick Hex key, 32 bytes, and you get an equally secure key right in your browser.
How long should a JWT or HMAC secret be?
For HMAC-SHA256 (the typical JWT algorithm HS256), the recommendation is a secret with at least 256 bits of entropy — 32 random bytes, or 64 hex characters. For HS384 and HS512, pick 48 or 64 bytes. What matters most is that the key comes from a cryptographic generator, not from a made-up password.
Is generating keys in the browser safe?
Yes. The tool uses the Web Crypto API (crypto.getRandomValues) — a cryptographically secure random number generator (CSPRNG) built into your browser, in the same class as openssl rand. Keys are never sent or stored anywhere; the page even works with the internet disconnected.
What is the difference between Base64 and Base64url?
Base64url is the URL- and filename-safe variant of Base64: it replaces + and / with a hyphen and an underscore and drops the = padding. It's used in JWT tokens and URL parameters, for example. If the key goes into an address, turn on the URL-safe option.
Can I generate multiple UUIDs at once?
Yes — set the count (up to 50) and they all appear in one batch. Copy them one by one, or grab the whole list with Copy all, one value per line. Handy for seeding test data or filling in fixtures.
Everything on this page runs offline-capable in your browser — generate a key, copy it, get on with your day.