What Is a Good Regex for UUID v4 Validation?
Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$. UUID v4 (Universally Unique Identifier version 4) is a randomly generated 128-bit identifier formatted as 32 hex digits in 5 groups separated by hyphens. The version nibble (position 13) is always 4, and the variant nibble (position 17) is 8, 9, a, or b.
Breaking Down the Pattern
| Part | Meaning |
|---|---|
^ | Start of string |
[0-9a-f]{8} | First group: 8 hex characters |
- | Literal hyphen separator |
[0-9a-f]{4} | Second group: 4 hex characters |
4[0-9a-f]{3} | Third group: starts with 4 (version), then 3 hex chars |
[89ab][0-9a-f]{3} | Fourth group: starts with 8, 9, a, or b (variant), then 3 hex chars |
[0-9a-f]{12}$ | Fifth group: 12 hex characters, end of string |
Test Cases
| Input | Match? | Note |
|---|---|---|
550e8400-e29b-41d4-a716-446655440000 | Yes | Valid format |
f47ac10b-58cc-4372-a567-0e02b2c3d479 | Yes | Valid format |
6ba7b810-9dad-41d4-80b4-00c04fd430c8 | Yes | Valid format |
550e8400-e29b-51d4-a716-446655440000 | No | Version 5, not 4 |
not-a-uuid | No | Wrong format entirely |
Usage Examples
JavaScript
const pattern = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
pattern.test('550e8400-e29b-41d4-a716-446655440000'); // true
pattern.test('550e8400-e29b-51d4-a716-446655440000'); // falsePython
import re
pattern = r'^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'
bool(re.match(pattern, '550e8400-e29b-41d4-a716-446655440000')) # True
bool(re.match(pattern, '550e8400-e29b-51d4-a716-446655440000')) # FalseCommon Pitfalls
- This pattern only matches UUID v4. Other versions (v1, v5, v7) have different version nibbles.
- UUIDs can be uppercase -- add the `i` flag or use `[0-9a-fA-F]` to match both cases.
- Some systems omit hyphens -- you may need a variant without separators.
Try It Yourself
Test this regex with our Regex Tester.
Frequently Asked Questions
What makes a UUID "version 4"?
UUID v4 uses random or pseudo-random numbers for all fields except the version (4) and variant (8/9/a/b) nibbles. This gives 122 bits of randomness, making collisions astronomically unlikely.
Should I validate UUIDs with regex?
For format validation, regex works well. For checking if a UUID actually exists in your system, you need a database lookup. Regex only confirms the string follows the UUID format.
Are UUIDs case-sensitive?
RFC 4122 specifies lowercase, but most implementations accept both. Add the case-insensitive flag (i) to your regex for maximum compatibility.