IPv6 ULA Generator

How to use this IPv6 ULA generator

1. Click "Generate New" to create a random ULA prefix.
2. Use it as the base for your private IPv6 network addressing.
3. Generate a new one anytime — each is independently randomized.

What is a ULA?

A Unique Local Address is a private IPv6 range (fc00::/7) intended for local networks, similar in spirit to RFC 1918 private IPv4 ranges. The 40-bit global ID is randomly generated so that networks combined later are unlikely to collide.

Why ULA replaced the deprecated "site-local" address concept

IPv6 originally had a different private addressing scheme called site-local addresses (fec0::/10), but the IETF formally deprecated it in RFC 3879 in 2004 because of a specific, real design flaw: since every organization was free to use the exact same site-local prefix, merging or interconnecting two networks that both used site-local addressing created unavoidable ambiguity about which network a given address actually belonged to. RFC 4193's Unique Local Address scheme, published the following year, fixed this specific problem by requiring the middle 40 bits of the prefix to be pseudo-randomly generated rather than left at a fixed, shared value, so that two independently created ULA prefixes are statistically very unlikely to collide even without any central coordination between the organizations that generated them.

How the RFC 4193 pseudo-random algorithm actually works

The 40-bit Global ID in a ULA prefix isn't generated with simple, uniform randomness — RFC 4193 specifies a particular algorithm meant to produce good distribution even on systems with limited access to high-quality entropy: it combines the current time with an identifier unique to the generating system's network interface (typically its MAC address), runs that combined value through the SHA-1 hash function, and takes the low-order 40 bits of the resulting hash as the Global ID. This deterministic-but-effectively-random process is specifically designed so that even two systems generating a prefix at nearly the same moment produce very different results, since the hash amplifies small differences in input into large differences in output.

The L bit — why generated ULAs specifically start with fd, not fc

The full ULA range is fc00::/7, but it's split into two halves by a single bit (the "L" bit): fc00::/8, reserved for a possible future centrally-assigned ULA registry that has never actually been implemented, and fd00::/8, defined for the locally-assigned addresses anyone can generate themselves using the RFC 4193 algorithm. Every ULA prefix generated by this tool (and by any standards-compliant ULA generator) starts with fd rather than fc specifically because of this distinction — fc00::/8 addresses would imply a centralized allocation authority that doesn't exist in practice, so locally-generated prefixes are required to use the fd00::/8 half instead.

ULA, link-local, and global unicast — the three IPv6 address scopes

IPv6 defines three broad categories of unicast address, and it's worth keeping them distinct since they serve different purposes. Link-local addresses (fe80::/10) are automatically self-assigned on every interface and only ever work on the local network segment — they're never routed anywhere, even within a private network. Global unicast addresses are the IPv6 equivalent of a public IPv4 address, meant to be globally routable on the internet. ULA sits between these two: routable within a private network (across multiple internal subnets, unlike link-local) but never meant to appear on the public internet (unlike global unicast) — functionally, it's IPv6's answer to what RFC 1918 private ranges (like 192.168.x.x) provide in IPv4.

Limitations of this tool

This generator implements the RFC 4193 algorithm to produce a locally-assigned ULA prefix in your browser — there's no central registry to check the result against, which is intentional (that's the entire design goal of the algorithm), but it also means this tool can't offer any stronger guarantee of uniqueness beyond the statistical properties of the algorithm itself. It generates the /48 prefix only, not a full subnetting plan for the /64 subnets within it, and it doesn't validate anything about how you actually deploy the prefix on your network — that planning is left to you once you have the generated prefix in hand.