UUID Generator

Validation patterns

UUID Regex Guide

Copy practical UUID regex patterns and learn what they validate, what they miss, and when a parser is safer than a regular expression.

By UUID GeneratorUpdated Reviewed for accuracy

A UUID regex is useful at input boundaries, but it should be honest about what it checks. A pattern can confirm the shape, version and variant; it cannot prove that an ID exists in your system or grants access.

Key takeaways

  • Use strict anchors so partial matches do not pass.
  • Check version and variant when those details matter.
  • Prefer a UUID parser in application code when one is available.

For implementation context, continue with UUID Validator, UUID v4, and UUID Security. These pages cover the closest generator, comparison, validation or storage decisions without repeating this guide.

Strict UUID regex

This pattern validates the common hyphenated UUID shape and checks the variant nibble. It accepts versions 1 through 8, which covers modern UUID layouts while rejecting many strings that only look close.

/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i

UUID v4 only regex

Use a version-specific pattern when your API only accepts one UUID version. For UUID v4, the first character of the third group must be 4.

/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i

Handling braces, URNs and compact UUIDs

Users paste identifiers from many places. Some tools wrap GUIDs in braces, some include a urn:uuid: prefix, and some remove hyphens. Decide which formats you will accept, then normalize to one storage format.

// Compact 32-character UUID string
/^[0-9a-f]{32}$/i

// URN format
/^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i

Regex is not authorization

A UUID regex can say that the string is shaped like a UUID. It cannot say that the current user owns the record, that the record exists, or that the request is safe. Keep validation and authorization as separate checks.

FAQ

UUID Regex Guide questions

Should a UUID regex allow uppercase letters?

Usually yes for input. Normalize to lowercase after validation if your system does not require uppercase output.

Can regex validate UUID version?

Yes. The version is encoded in the first character of the third group. Use a version-specific pattern when needed.

Is regex enough for database IDs?

Regex is only the first check. The database or application still needs to confirm the record exists and the user can access it.

UUID Regex Guide - Validate UUID and GUID Strings