What this validator checks
Paste any identifier into the box and this tool tests it against the strict shape of a UUID defined by RFC 4122: exactly five groups of hexadecimal digits — 8, then 4, then 4, then 4, then 12 — separated by hyphens, 36 characters in total. Two of the digits carry required values rather than random ones, and the validator enforces both: the first digit of the third group must be 1, 2, 3, 4 or 5 (the version field — this tool reports which version you have), and the first digit of the fourth group must be 8, 9, a or b (the marker of the standard variant). Uppercase and lowercase hex are both accepted, since the standard treats them as equivalent. When everything checks out, the verdict names the version; when something fails, you get a plain "not a valid UUID" with the correct pattern to compare against, character by character.
It is worth knowing what validation does not promise. A valid result means the string is shaped like a real UUID — it cannot mean the identifier was ever issued, belongs to the system you think it does, or is safe to trust. Format is checkable; provenance is not, and anyone can mint a perfectly valid UUID (the companion UUID Generator does it in a click).
Anatomy of a UUID
| Group | Length | What it holds |
|---|---|---|
| 1 | 8 hex digits | Random or time-based data |
| 2 | 4 hex digits | Random or time-based data |
| 3 | 4 hex digits | Starts with the version (1–5) |
| 4 | 4 hex digits | Starts with the variant (8, 9, a or b) |
| 5 | 12 hex digits | Random, time-based or name-based data |
The versions describe how the identifier was made: version 1 from a timestamp and machine address, version 3 and 5 by hashing a name (with MD5 and SHA-1 respectively), version 4 — by far the most common today — from random numbers, and version 2, a rarely seen variant of version 1 used in a few legacy systems. Seeing version 1 in the wild tells you the identifier is probably older or comes from infrastructure software; version 4 tells you nothing at all about its origin, which is precisely its purpose.
Why identifiers fail validation
The usual suspects, in order of frequency: a character lost or added in copying, which the 36-character length and group pattern catch immediately; the hyphens stripped along the way, leaving a 32-digit hex string that many systems accept internally but which is not the canonical text form — re-insert hyphens after characters 8, 12, 16 and 20 and it will usually validate; braces kept from a Windows registry export, which must be removed first; and — the subtle one — a string that is almost a UUID but has a version digit of 0 or 6+, or a variant digit outside 8/9/a/b, meaning it is some other kind of identifier wearing a UUID's shape. The all-zeros value (the "nil UUID") is a special case: it is a legitimate placeholder in the standard, but its version digit is 0, so this validator reports it as invalid rather than pretending it is an ordinary identifier.
Frequently asked questions
Does a valid result mean the UUID is genuine or safe?
No — it means the string is correctly formatted as a UUID with a recognized version and variant. Validation cannot confirm who created it, what it identifies, or that it is safe to trust; anyone can generate a valid UUID.
Is a UUID without hyphens valid?
Not in canonical text form. The hyphens are part of the standard format (groups of 8-4-4-4-12). Some systems store the 32 hex digits bare internally; add hyphens after digits 8, 12, 16 and 20 and the value should validate here.
What about the all-zeros UUID?
00000000-0000-0000-0000-000000000000 is the 'nil UUID', a defined placeholder meaning 'no identifier'. Because its version digit is 0 rather than 1–5, this validator reports it as invalid — treat a nil UUID in data as an empty or unset value.
Does uppercase versus lowercase matter?
No. Hexadecimal digits a–f may be written either way and this validator accepts both, matching the standard. The generated form on most systems, including our UUID Generator, is lowercase.
Private by design: this validator runs entirely in your browser. The identifiers you paste here are never uploaded, stored or shared — safe for checking internal IDs.