UUID in PHP

PHP UUID Generator

PHP has no UUID function, only a random byte source — so the value is assembled by hand, and getting the version nibble right is the whole trick.

random_bytes()RFC 9562 correctOr ramsey/uuid

Version

How many

Uppercase Hyphens Braces { }

Result

Generated locally with the Web Crypto API — nothing leaves your browser.

Generating UUIDs in PHP

random_bytes(16) is the CSPRNG primitive. To turn those bytes into a valid v4 UUID you must overwrite two nibbles: byte 6's high nibble becomes 4 (the version) and byte 8's top two bits become 10 (the RFC variant). Skip that step and you have 16 random bytes that most validators will reject — the commonest bug in hand-rolled PHP UUID code.
If you would rather not maintain bit arithmetic, composer require ramsey/uuid gives Uuid::uuid4() and all the other versions, including v7 for time-ordered keys. Either way, random_bytes stays the source: what matters is that IDs are never built from rand() or uniqid().

How to generate

Press Generate UUID above to mint a value in this browser — nothing is sent anywhere.
Copy one value with Copy, or set How many and use Copy all for a fixture list.
Switch Version if your code needs v7 instead of the v4 default, and turn on Formatting to match your stack's conventions.

Use Cases

Laravel and Eloquent keys — a $keyType = 'string' model with a UUID primary key.
Upload and object names so a user-supplied filename never touches the filesystem.
CSRF or reset tokens, where a predictable value would be a vulnerability.

How PHP UUID Generator Compares

random_bytes(16)	CSPRNG; pair it with the version/variant bytes yourself
ramsey/uuid	All versions, parsing and validation, well maintained
uniqid() / rand()	Predictable and time-based — never for identifiers you rely on

Code Examples

PHP

<?php
// A v4 UUID from 16 random bytes, with the RFC 9562 bits set
$b = random_bytes(16);
$b[6] = chr((ord($b[6]) & 0x0f) | 0x40); // version 4
$b[8] = chr((ord($b[8]) & 0x3f) | 0x80); // RFC variant

$uuid = vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($b), 4));
echo $uuid; // 8f2c7b41-0d3e-4a55-b6c1-8e7d9f0a1b2c

With ramsey/uuid

<?php
// composer require ramsey/uuid
use Ramsey\Uuid\Uuid;

$id = Uuid::uuid4()->toString();   // v4
$v7 = Uuid::uuid7()->toString();   // v7, time-ordered (ramsey/uuid 4.7+)

Frequently Asked Questions

Does PHP have a built-in UUID function?

No. random_bytes() provides the entropy; either assemble the UUID yourself (setting the version and variant bytes) or use the ramsey/uuid package.

Why is my hand-made UUID rejected by validators?

Because the version and variant nibbles were not set. Byte 6 must have 4 in its high nibble and byte 8 must have its top two bits set to 10.

Can I use uniqid() for a UUID?

No. uniqid() is derived from the system clock, so values are predictable and collide under concurrency. Use random_bytes().