Skip to content
Lizely

ULID Generator

Generate monotonic ULID batches from cryptographic randomness and decode the embedded millisecond timestamp.

Privacy: your files never leave your device. All processing happens locally in your browser.

How to use

  1. 1.Choose Generate, set a quantity from 1 to 100, and create a monotonic batch.
  2. 2.Copy the full identifiers and store them in a case-preserving field with a unique constraint.
  3. 3.Choose Decode, paste a canonical ULID, and read its millisecond and UTC timestamp.

About ULID Generator

ULID Generator creates canonical Universally Unique Lexicographically Sortable Identifiers and decodes their embedded timestamp. A ULID is 26 Crockford Base32 characters: the first 10 encode a Unix timestamp in milliseconds and the final 16 encode 80 bits of randomness. Generate from 1 through 100 values in one click, or switch to Decode to read the timestamp and ISO UTC instant from an existing canonical string.

Generation uses the browser cryptographic random source for the initial 80-bit value. Every ID in one clicked batch uses the same captured millisecond and increments that random region by one, including carry, so the returned strings are strictly increasing in normal ASCII lexical order. If the 80-bit field would overflow, generation fails instead of wrapping. This implements the specification's monotonic behavior within the batch without storing identifiers or hidden state across clicks.

The timestamp must fit the ULID 48-bit unsigned range, from zero through 281474976710655 milliseconds. The maximum canonical string therefore begins with 7; a 26-character Base32 value beginning with 8 or above contains more than 128 bits and is rejected. The alphabet excludes I, L, O, and U to reduce ambiguity. Decoding is case-insensitive but accepts only characters from the canonical alphabet after normalization.

The left-hand time field makes ULIDs useful for ordered indexes and log correlation, but it also exposes approximate creation time. Do not use a ULID when that metadata is sensitive. Lexical sorting assumes the canonical 26-character representation and ordinary bytewise or ASCII-compatible collation. Case-folding, locale collation, truncation, padding, or storage in an undersized column can break the intended order. Test the exact database collation and schema.

Randomness reduces collision probability but does not create an absolute uniqueness guarantee. A durable database should enforce a unique constraint and handle a conflict atomically. The tool checks batch construction and monotonic overflow, but it cannot coordinate with other tabs, devices, services, or previously generated values. Never use a check-then-insert race as the final uniqueness control.

An identifier is not a password, API key, bearer token, authorization rule, or encryption key. The visible timestamp and random suffix do not protect a record from enumeration or disclosure if access control is missing. Generate credentials with the target platform's dedicated mechanism and store them in a secret manager. Avoid logging ULIDs if they are linked to personal or confidential records.

All generation, decoding, formatting, and copying happen in the browser. No identifier or timestamp is uploaded. The page uses Date.now only inside the Generate click handler, not during server rendering, which keeps the initial page deterministic. A displayed ISO time is UTC; local calendar presentation can differ by time zone even though the millisecond value is unchanged.

Eight external fixtures lock zero, base32 boundaries, one second, the reference decodeTime example, and the maximum timestamp. Additional tests assert a three-item deterministic monotonic batch, alphabet size, invalid 130-bit input, and random overflow. For reliable use, keep the full uppercase string, store it in a case-preserving 26-character field, enforce uniqueness, and treat the decoded time as metadata rather than authenticated truth.

Methodology & sources

Captures one integer millisecond per click, encodes it into 10 Crockford Base32 characters, obtains 80 cryptographic random bits, increments that field monotonically for the batch, rejects 80-bit overflow, and decodes only canonical 26-character values within the 128-bit limit.

Frequently asked questions

Are ULIDs guaranteed never to collide?
No random identifier has an absolute guarantee. Use a database unique constraint and handle a conflict atomically even with a large 80-bit random field.
Why can someone read a time from my ULID?
The first 48 bits intentionally encode Unix milliseconds to support lexical time ordering. Do not use ULIDs when approximate creation time must remain hidden.
Does a ULID work as an access token?
No. Identifiers do not replace authentication or authorization, and the timestamp is public metadata. Use a dedicated credential system for secrets.

Related tools

Developer Tools guides

View all