UUID v3 Generator (Name Based, MD5)

What a UUID v3 is

Version 3 is the older of the two name based UUIDs. It takes a namespace UUID and a name, runs them through MD5, and uses the 128 bit digest as the UUID with the version and variant bits set. The same namespace and name always give the same result. It differs from v5 only in the hash: MD5 here, SHA-1 there.

When you meet v3

• Java. UUID.nameUUIDFromBytes(bytes) in the standard library produces a v3 UUID, and it hashes the raw bytes you pass with no namespace. To reproduce a Java id elsewhere, hash the same bytes with MD5 and set the version to 3.
• Older systems that adopted name based ids before v5 was common, and any data that must stay compatible with them.

For new work the RFC recommends v5. MD5 is not a security risk for making identifiers, but there is no reason to pick it when SHA-1 is equally available.

Standard namespaces

v3 uses the same namespaces as v5: DNS, URL, OID and X.500, listed with their values on the v5 page. Pick DNS for domain names, URL for URLs, or paste your own UUID as a custom namespace.

Generate a v3 UUID in code

// Java, note there is no namespace parameter
UUID id = UUID.nameUUIDFromBytes("example.com".getBytes(StandardCharsets.UTF_8));

# Python, with a namespace
import uuid
uuid.uuid3(uuid.NAMESPACE_DNS, "example.com")
# '9073926b-929f-31c2-abc9-fad77ae3e8eb'

// JavaScript, uuid package
import { v3 as uuidv3 } from "uuid";
uuidv3("example.com", uuidv3.DNS);

Enter example.com above with the DNS namespace and you get the Python value. Java's version will differ because it skips the namespace.

Frequently asked questions

v3 or v5?

v5 unless you need to match ids that an existing system already produced with v3. The two are otherwise interchangeable in how you use them.

Why does Java's nameUUIDFromBytes give a different result from this page?

Java hashes only the bytes you pass in. The RFC method hashes the namespace UUID followed by the name. To match Java, you would use an empty namespace, which this page does not offer because it is not part of the standard.

Is MD5 safe enough for this?

For identifiers, yes. The weakness of MD5 is that an attacker can craft two inputs with the same hash. That does not matter when you are the one choosing the names and only want a stable id for each.