UUID v4 Explained: Format, Randomness, and Collision Limits

What a UUID v4 identifies

A UUID is a 128-bit (16-octet) identifier. Version 4 uses random or pseudorandom input, unlike versions based on time or names. It is commonly written as 32 lowercase hexadecimal digits in an 8-4-4-4-12 grouping. The hyphens are a readable representation, not extra random bits.

Version, variant, and random bits

The Calzivo UUID Generator requests 16 bytes from browser crypto.getRandomValues(). It sets the high nibble of byte 6 to 4 for version 4 and the two high bits of byte 8 to 10 for the RFC variant. The other 122 bits remain random. In the formatted string, the first digit of the third group is therefore 4, and the first digit of the fourth group is one of 8, 9, a, or b. For bit-layout illustration only, sixteen zero input bytes would format as 00000000-0000-4000-8000-000000000000; this fixed illustration is not a generated random value.

Collision probability is not a guarantee

With 122 random bits, independent well-generated UUID v4 values have a very large space and a low collision probability at ordinary scales. That is not a mathematical guarantee of uniqueness. Calzivo checks duplicates within one requested batch and fails the whole batch visibly if one occurs; it does not check other batches, databases, or other systems. Where uniqueness is essential, retain a database uniqueness constraint or equivalent check.

Browser generation and bulk output

Web Crypto provides cryptographically strong random values in the browser. Calzivo accepts a whole-number count from 1 through 100, generates in order, and shows the values in that order. Download is UTF-8 text/plain, with one UUID per line separated by LF and no trailing newline. A failed duplicate or unavailable random source is an error, not a partial success.

Identifiers are not automatically credentials

A UUID is designed for identification. Its random origin does not by itself make it a password, an encryption key, or a safe bearer token. Do not treat a visible or guessable-by-context identifier as proof of authorization. Use a purpose-designed authentication or token system where secrecy and access control matter.