UUID Validator

Paste a UUID and this tells you whether it's valid, which version it is, and which variant, all as you type. But valid-or-not is the easy half, and it's the half you didn't need help with. The moment you actually reach for a validator is when something already failed, and a bare "invalid" is exactly where most of them quit on you. This one does the useful part instead: on a failure it names what's actually wrong, and on a pass it highlights the exact version digit so you're not counting hex characters with your finger on the screen, then names the variant the value is carrying.

It all runs in your browser. The UUIDs you paste are usually live database keys or session tokens, and there's no reason a plain format check should send them off to someone else's server. Nothing here is uploaded, logged, or kept.

Nearly every other checker falls down at the same spot. Your value doesn't match, so it hands you the word "invalid" and walks away. That's useless at the precise moment you needed help, because "invalid" covers two completely different situations: a value that's basically right with one character out of place, or genuine garbage. You can't tell which from a red X, so you end up squinting at a 36-character monospace string where every part looks the same after a few seconds.

This tool tells you which. Paste 32 correct hex characters with no hyphens and it says "32 hex chars but missing the four hyphens," so you know it's your UUID and just needs the dashes back. Put the right characters in with the hyphens sitting in the wrong spots and it says exactly that. Drop an l where a 1 belongs, or any character that isn't a hex digit, and it points straight at the culprit instead of shrugging. Come up short or long and it counts for you, "wrong length, 30 hex digits, a UUID needs 32." That specificity is the whole difference between a five-second fix and five minutes of hunting through a column you already can't read.

One thing it flatly refuses to do is guess. The hyphen-less 32-character run is the clearest case, 550e8400e29b41d4a716446655440000 could just as easily be an MD5 hash or a chopped-off token, so rather than quietly adding dashes and pretending everything's fine it marks the value invalid and tells you it's close. You decide whether to add the hyphens back, not the tool. In real code you'd validate with your language's library, uuid.UUID(), Guid.TryParse, the uuid package's validate(), and this is for the in-between moment: a suspicious value on your clipboard and no appetite for opening a REPL over it. A quick regex tester approximates the shape too, but a shape-only pattern won't decode the version or catch a bad variant bit.

A UUID is a 128-bit value written out as 32 hex digits in the 8-4-4-4-12 shape, like 550e8400-e29b-41d4-a716-446655440000. The hyphens are only there so a person can read the thing without going cross-eyed. Two of those digits aren't part of the payload though, they're metadata about the UUID itself, and plenty of validators never bother to read them.

The version is the 13th hex digit, the first character of the third group. In 550e8400-e29b-41d4-a716-446655440000 the third group is 41d4, and that leading 4 is the version. The tool highlights that exact digit in the result, on any value whose variant says it has a version, so you never have to find it by hand. A 4 there means random, a 1 means time-based, a 7 is the newer time-sortable kind whose timestamp front makes new database rows insert in order instead of scattering across the index. It knows all eight defined versions, v1 through v8, so a stray v1 that wandered into a v4-only pipeline gets surfaced rather than waved through.

The variant is fussier, since it lives in a couple of bits rather than a whole digit. It's read off the top of the 17th character and it says which UUID standard the value follows. For anything you'll meet in modern code you want the RFC 4122/9562 variant, which turns up as an 8, 9, a, or b in that spot. See an NCS or Microsoft variant instead and the value either predates the modern spec or came out of a legacy Windows GUID scheme, which is worth a second look but not a reason to panic. A lot of checkers never read that bit at all, which is precisely how a value with wrong variant bits slides past as "fine." Reading it is also why an NCS or Microsoft value comes back amber here with no version number on it. RFC 9562 puts the meaning of every other bit under the variant field, so outside the modern layout the 13th digit is not a version, and printing one would be making it up. That matters most in the case people actually open a validator for, checking that some identifier really is an unguessable v4.

Two values get special handling because a naive validator trips on both. The nil UUID, all zeros, is a real RFC-defined UUID that means "none" or "empty," the identifier version of a null, so the tool labels it "nil UUID" instead of insisting it's version 0. Its opposite is the max UUID, all f's, valid too and sometimes used as an upper bound in a range query. If your own code rejects the nil UUID as malformed, that's a bug in your validation and not in the value.

Keep one line straight while you read the green result, though. A pass confirms the string is shaped like a UUID and carries a recognizable version, and that's all it confirms. Someone can hand-type 12345678-1234-4123-8123-123456789012 and it'll sail through as a valid version 4 while being completely made up. Whether a value is actually unique depends on how it was generated, not how it's written, and no format check can vouch for that.

1. Paste your UUID into the box. One value, or a whole column with one per line, straight from a database export, a log grep, or a test fixture. Braces, a urn:uuid: prefix, and quotes copied out of JSON are all stripped for you.
2. Read the result as you type. There's no button to press, each line gets its own verdict the moment it lands.
3. On a valid UUID you'll see it echoed back in canonical lowercase with the version digit highlighted, plus the version number, what that version means, and the variant. Where the variant is not the modern one, the highlight and the version number come off and you get the reason in their place.
4. On the nil or max UUID it's labeled as exactly that, instead of being forced into a version number it doesn't have.
5. On an invalid value you get the specific reason, wrong length, a non-hex character, or misplaced hyphens, so you know whether to fix it or throw it out.
6. Checking a list, the count up top tallies passes and failures, and a third count for any value whose variant bits are not the RFC ones, so you can scan a thousand-row export and jump straight to the rows that need you.

Hit Load sample to watch it run first. It drops in a v4, a v1, the nil UUID, a URN-wrapped value, a braced one, and a deliberately broken string.