Is this GUID generator free to use?

Yes. All tools on KeyForge are free, with no account, rate limit, or usage cap.

Are my keys, plaintext, or generated GUIDs sent to a server?

No. Every operation — UUID generation, encryption, decryption, and hashing — runs locally in your browser using the Web Crypto API. Nothing is transmitted to or stored on our servers.

Which UUID version should I use?

Use v4 for general-purpose unique identifiers — it is random and collision-resistant. Use v5 when you need the same input to always produce the same UUID (e.g. deriving an ID from a URL). Use v1 only if you specifically need a timestamp-ordered identifier.

Should I use AES-CBC or AES-GCM?

Prefer AES-GCM when available. It provides authenticated encryption, meaning any tampering with the ciphertext is detected automatically on decryption. AES-CBC encrypts the data but does not verify its integrity on its own.

Is MD5 or SHA-1 safe to use?

Not for security-sensitive purposes. Both have known collision vulnerabilities and are unsuitable for password hashing or digital signatures. They remain fine for simple checksums where security is not a concern. Use SHA-256 or SHA-512 instead.

Is Base64 encoding the same as encryption?

No. Base64 (and hex) encoding is a reversible text representation with no key and no security — anyone can decode it instantly. Use AES if you need actual confidentiality.

Why Your JSON.stringify() Output Looks Different From What You Expected

JSON.stringify()feels like a simple, predictable function until it isn't. A field you expected quietly disappears, keys come out in an order you did not specify, or the whole call throws an error with no obvious cause. None of this is random. Each behavior follows a specific rule that is easy to miss the first time you run into it.

Fields that disappear entirely

JSON.stringify() silently omits any object property whose value is undefined, a function, or a Symbol, rather than throwing an error or including a null placeholder:

JSON.stringify({ name: "Freddy", role: undefined })
// '{"name":"Freddy"}'  -- role is just gone

This is intentional, not a bug, since JSON has no way to represent undefined or a function at all. If you actually need that field present with an explicit null, set the value to null before calling stringify rather than leaving it undefined.

Key order that does not match your object literal

In practice, modern JavaScript engines preserve insertion order for string keys, with one exception: keys that look like non-negative integers get sorted numerically and placed before all other keys, regardless of where you wrote them in the source:

JSON.stringify({ b: 1, 2: "two", a: 3 })
// '{"2":"two","b":1,"a":3}'

This is part of the ECMAScript specification for property enumeration order, not a quirk of one engine, so it will show up consistently across browsers and Node.js versions. If your code relies on a specific key order for anything other than display purposes, it is worth being aware this rule exists.

Throwing on circular references

If an object contains a reference back to itself, directly or through a chain of other objects, JSON.stringify() throws a TypeError: Converting circular structure to JSON rather than looping forever. This comes up most often with objects that reference their own parent, or with certain framework internals (like some DOM nodes) that have circular structures built in by design. The fix is usually to strip out the circular reference before serializing, either manually or with a custom replacer function passed as the second argument to stringify.

The toJSON escape hatch

If an object has a toJSON() method defined on it, JSON.stringify()calls that method and serializes its return value instead of the object's own properties. This is how Dateobjects end up as ISO date strings in JSON output rather than a dump of their internal fields. It is worth knowing this exists, since it explains a lot of "why does this object serialize differently than I expected" cases that have nothing to do with the rules above.

Checking your own output

When something in a stringified payload does not look right, pasting the result into the JSON Formatter on this site will at least confirm whether the output is valid JSON to begin with, which is a useful first step before chasing down which of the rules above is actually responsible.