UUID decoder & hex identifier lookup
Found a strange ID in a log, a URL, a startup entry or a device list and wondering what it is? Paste it here. The decoder recognises UUIDs/GUIDs (and extracts the hidden timestamp and MAC address where one exists), MongoDB ObjectIds, ULIDs, Snowflake IDs, MD5/SHA hashes, MAC addresses, IP addresses, Unix timestamps and hexadecimal error codes.
Try: UUID v7 · ObjectId · 0x80070005 · ULID · 1cc1.de81.fd31 · 1700000000
What is a UUID (GUID)?
A UUID (Universally Unique Identifier) — called a GUID on Windows — is a 128-bit value written as 32 hex digits in five groups: 8-4-4-4-12. Software generates them so that independent systems can create IDs without ever colliding: database rows, installer packages, Windows registry and COM classes, Bluetooth services, browser extensions and countless log entries. Seeing an unfamiliar one in Task Manager's startup list or a device list is normal — it's a name chosen by software, not a sign of anything malicious by itself.
Reading the version and variant
The first digit of the third group is the version, which tells you how the UUID was made:
- v1 — timestamp + the generating machine's MAC address (so it reveals when and potentially which network card created it).
- v3 / v5 — a hash (MD5 / SHA-1) of a name in a namespace; the same input always yields the same UUID.
- v4 — 122 random bits; carries no information at all.
- v6 / v7 — modern, sortable time-ordered UUIDs (RFC 9562). v7 embeds a Unix millisecond timestamp.
The first digit of the fourth group gives the variant: 8–b is the standard RFC layout; c/d marks Microsoft's legacy GUID layout.
Other IDs this tool recognises
- MongoDB ObjectId — 24 hex digits; the first 8 are a creation timestamp.
- ULID — 26 characters of Crockford Base32, sortable, with a millisecond timestamp in the first 10.
- Snowflake IDs — 17–19 digit numbers used by X/Twitter and Discord, with a timestamp in the high bits.
- Hashes — 32 hex (MD5), 40 hex (SHA-1, also Git commit IDs), 64 hex (SHA-256), 128 hex (SHA-512). Hashes are one-way: they can't be decoded back to the input.
- MAC addresses — 12 hex digits in any format, decoded with our MAC address lookup.
- 32-bit hex values — shown as signed/unsigned integers, as an IPv4 address (see the IP converter) and, when the high bit is set, as a Windows HRESULT error code.
Frequently Asked Questions
Can a UUID be traced back to a person or device?
Only version 1 (and some v2) UUIDs contain the generating machine's MAC address and a timestamp; this tool extracts both. Version 4 UUIDs are random and reveal nothing. v7 reveals only when it was created.
I found an unknown GUID in my startup programs or device list. Is it a virus?
Not by itself — Windows, drivers and apps name thousands of components with GUIDs. Check the file path or publisher it belongs to instead. If it is a v1 GUID, the embedded timestamp shows when it was generated, which can help match it to an install.
Is a GUID the same as a UUID?
Yes. GUID is Microsoft's name for the same 128-bit format. One quirk: when Windows stores a GUID as raw bytes, the first three groups are little-endian, so a byte dump may look reversed compared to the text form.
Can you decode an MD5 or SHA hash?
No. Hashes are one-way by design. The tool can tell you which algorithm a hex string most likely came from, based on its length, but not what was hashed.
Got an IP or MAC instead?
Trace an IP address to its location and network, or a MAC address to its manufacturer.
Open IP Geolocation