UUID v4 regex

What it matches

A UUID v4 is 128 bits of randomness shaped like `xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx`, where `M` is always `4` (the version) and the first hex of `N` is always `8`, `9`, `a`, or `b` (the variant). This pattern enforces both. If you only need to check 'is this a UUID-shaped string' without caring about the version, swap `4[0-9a-f]{3}` for `[0-9a-f]{4}` and `[89ab][0-9a-f]{3}` for `[0-9a-f]{4}`.

Examples

Edge cases & gotchas

• Will NOT match UUID v1, v3, v5, v6, or v7 — those have different version digits. If you need to accept any version, use `[0-9a-f]` in place of `4` and `[0-9a-f]` in place of `[89ab]`.
• Hyphens are required exactly where shown — UUIDs without hyphens (raw hex form) don't match. Add `?` after each `-` if you want both forms.
• Doesn't reject the all-zero UUID (`00000000-0000-4000-8000-000000000000`). That's a valid v4 UUID by spec but usually means a bug.
• Doesn't check Unicode normalization — Greek lookalikes (`Α` vs `A`) won't match, which is what you want.

In your language

// JavaScript
const re = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
const match = "input".match(re);

All 13 languages (including Bash, Perl, Kotlin, Swift) available in the full toolkit Export tab.

Notes for production

• ULIDs and KSUIDs are NOT UUIDs and won't match this pattern. They have their own formats (base32 / base62, different lengths).
• If you're generating UUIDs in JS, `crypto.randomUUID()` produces v4 since Node 18 and is the right call for anything new.

Frequently asked

Related patterns