UUID v4 Regex Validator
UUIDs show up in API paths, database rows, event logs and integration payloads. A loose UUID-looking pattern can pass values that are not version 4 UUIDs, so the version and variant characters should be checked when the system expects UUID v4.
Open the Formalint Regex Matcher to test this UUID pattern now.
UUID v4 Regex
^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$The third group starts with 4, which marks UUID version 4. The fourth group starts with 8, 9, a or b, which checks the common UUID variant bits. Add the case-insensitive flag if your values may contain uppercase hex characters.
Test Values
550e8400-e29b-41d4-a716-446655440000
550e8400-e29b-11d4-a716-446655440000
550e8400e29b41d4a716446655440000
not-a-uuid
550E8400-E29B-41D4-A716-446655440000Where UUID Regex Helps
Use a UUID regex when filtering logs, validating route parameters or checking sample payloads before they reach an API. It is also helpful in test data generators where invalid IDs hide real integration failures.
Do Not Treat UUID as Authorization
A valid UUID only proves the string has the expected shape. It does not prove the user can access the resource behind that ID. Authorization must still happen in the application or API layer.
Implementation Checklist
Decide whether uppercase hex characters should be accepted, normalize case only if your application already treats IDs case-insensitively and keep the hyphenated format consistent across logs and APIs. If the ID is part of a URL path, validate after URL decoding so encoded characters cannot hide a malformed value.
When debugging APIs, test a valid UUID that exists, a valid UUID that does not exist and an invalid UUID string. Those three cases often map to different responses such as 200, 404 and 400.
Common UUID Regex Mistakes
A generic UUID regex may accept version 1, version 3 or version 5 IDs when the endpoint expects version 4. If the version matters, keep the version and variant checks in the expression instead of only checking length and hyphens.
Frequently Asked UUID Regex Questions
Should UUID validation be case-sensitive? UUID hex is commonly treated case-insensitively, but many teams normalize to lowercase for consistency in logs and database records.
Can a regex tell whether a UUID exists? No. It can only validate the string shape. Existence requires a lookup in the application or database.
Related Formalint Pages
Use UUID Generator to create sample IDs, JSON Schema Generator for payload contracts and Regex Examples for more validation patterns.