UUID Format Explained: Versions, Regex and Validation

A UUID looks like a random string, but several characters carry structure. Knowing which positions identify the version and variant helps you validate input correctly and avoid rejecting valid GUIDs because of casing or harmless presentation differences.

The canonical UUID format

The common text representation is xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx, where each x is a hexadecimal digit. The groups contain 8, 4, 4, 4, and 12 digits, for 32 hex digits plus four hyphens—36 characters in total.

Example: 550e8400-e29b-41d4-a716-446655440000

The M position indicates the UUID version. In this example it is 4, so the value is UUID v4. The high bits represented by N identify the variant; standard RFC UUIDs commonly show 8, 9, a, or b there.

UUID versions at a glance

• v1: timestamp and node based; can disclose time and node information.
• v3: deterministic namespace-and-name UUID using MD5.
• v4: random, with 122 random bits after version and variant fields.
• v5: deterministic namespace-and-name UUID using SHA-1.
• v6: reordered time-based format designed for sorting.
• v7: Unix-millisecond time prefix plus random data, designed for sortable modern IDs.
• v8: application-defined layout within the UUID framework.

For the two most common choices in new applications, see UUID v4 vs v7.

A general UUID regex

This checks the canonical 8-4-4-4-12 shape without restricting the version:

^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$

To require a standard variant and versions 1 through 8, tighten the middle groups:

^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$

Try either expression with sample values in the Regex Tester.

Why regex is only the first validation layer

A regex confirms that text has the expected characters in the expected places. It does not prove the value was generated securely, that a v7 timestamp is plausible, or that a v5 UUID used the namespace your application expects. After a shape check, parse with your platform's UUID library and apply domain-specific rules.

GUID formatting differences

Microsoft tools may display the same 128-bit value in uppercase or inside braces, such as {550E8400-E29B-41D4-A716-446655440000}. Some systems use a urn:uuid: prefix. These are textual wrappers around the same identifier. Normalize deliberately rather than stripping arbitrary punctuation from untrusted input. See GUID vs UUID for the naming and byte-order details.

Nil and max UUIDs

The nil UUID contains all zero bits: 00000000-0000-0000-0000-000000000000. The max UUID contains all one bits and displays as all f characters. Both are reserved special values, not normal generated identifiers. Decide explicitly whether an input field permits them.

Safe validation checklist

1. Trim only whitespace your input contract permits.
2. Parse with a maintained UUID library.
3. Verify the required version and variant when they matter.
4. Reject nil or other reserved values if the field requires a generated ID.
5. Normalize the value for display and comparison.
6. Store it as a native UUID or 16-byte value rather than relying on text formatting.

Generate valid examples

Use the UUID Generator to create valid v4 and v7 examples in lowercase, uppercase, with or without hyphens, and in bulk. For production application code, follow how to generate a UUID with your platform's secure standard implementation.