Regex for a UUID
^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ with the i flag matches any UUID in the 8-4-4-4-12 hex format. For version 4 (random) only, use ^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$.
JavaScript ✓PCRE ✓
No catastrophic-backtracking patterns found. (A heuristic check: nested and adjacent repeats, overlapping alternatives.)
^Start of the stringanchor[0-9a-f]One character: 0-9 (digits) or a-f (either case, because of the i flag)character class{8}Repeat the class exactly 8 timesquantifier-The character '-' literally (any case, because of the i flag)literal[0-9a-f]One character: 0-9 (digits) or a-f (either case, because of the i flag)character class{4}Repeat the class exactly 4 timesquantifier-The character '-' literally (any case, because of the i flag)literal[0-9a-f]One character: 0-9 (digits) or a-f (either case, because of the i flag)character class{4}Repeat the class exactly 4 timesquantifier-The character '-' literally (any case, because of the i flag)literal[0-9a-f]One character: 0-9 (digits) or a-f (either case, because of the i flag)character class{4}Repeat the class exactly 4 timesquantifier-The character '-' literally (any case, because of the i flag)literal[0-9a-f]One character: 0-9 (digits) or a-f (either case, because of the i flag)character class{12}Repeat the class exactly 12 timesquantifier$End of the stringanchor
Examples
Checked at build time in JavaScript and in Python's re.
| Input | Matches? |
|---|---|
123e4567-e89b-12d3-a456-426614174000 | ✓ match |
F47AC10B-58CC-4372-A567-0E02B2C3D479 | ✓ match |
00000000-0000-0000-0000-000000000000 | ✓ match |
123e4567e89b12d3a456426614174000 | ✗ no match |
{123e4567-e89b-12d3-a456-426614174000} | ✗ no match |
123e4567-e89b-12d3-a456-42661417400 | ✗ no match |
g23e4567-e89b-12d3-a456-426614174000 | ✗ no match |
017f22e2-79b0-7cc3-98c4-dc0c0c07398f | ✓ match |
Try your own text
One string per line: each line is tested on its own (the m flag is added here).
How it works
A UUID is 128 bits written as 32 hex digits in groups of 8, 4, 4, 4 and 12. Two positions carry meaning. The first digit of the third group is the version: 4 for random UUIDs, 7 for the time-ordered ones defined in RFC 9562 (2024). The first digit of the fourth group holds the variant, which is 8, 9, a or b for standard UUIDs.
The generic pattern checks only the shape. That is usually right for input you just need to route to a database lookup. Check the version only when your system generates one specific kind and something else showing up indicates a bug.
Variants
/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iVersion 4 (random) only, with the standard variant bits. This is whatcrypto.randomUUID()produces./^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iAny version defined in RFC 9562 (1-8) with the standard variant. Rejects the nil and max UUIDs.
Gotchas
- The nil UUID (all zeros) and the max UUID (all
f) match the generic pattern. If those are sentinels in your system, reject them separately. - Microsoft tools often write GUIDs in braces:
{...}. Strip them before testing, or allow^\{?and\}?$. - RFC 9562 says to generate lowercase and accept uppercase. Without the
iflag, uppercase UUIDs fail. - Some databases store UUIDs as 32 hex digits without hyphens. Use
^[0-9a-f]{32}$for that form.
Related explainers
- Regex for a hex color codeA regex for CSS hex colors in #rgb and #rrggbb form, plus the 4- and 8-digit forms with alpha, and the...
- Regex for a URL slugA regex that validates URL slugs like my-first-post: lowercase letters and digits joined by single...
- Regex for a semantic version (SemVer)A readable regex for semantic versions like 1.2.3-beta.1+build.5, how it differs from the official...