Ctrl K

Test data that cannot reach a real person, built safe on purpose

Updated on 15 October 2026

The short answer. Make every value unusable outside a test by construction: emails at example.com (reserved by RFC 2606), IP addresses from the 768 in the three RFC 5737 documentation blocks, card numbers copied from Stripe's or Razorpay's published test lists, and a seed so the same rows come back. Phone numbers are the one field this cannot cover in India.

Test data leaks. A seed file loaded into staging sends a welcome email, a demo screenshot ends up in a slide deck, a fixture with a card number is pasted into a bug report. Careful handling helps, but the stronger rule is to choose values that do no harm wherever they end up: an address no mail server will deliver to, an IP no machine answers on, a card no bank will charge.

A safe row, field by field

Field Value in a fixture Why it cannot reach anyone
Email priya.sharma@example.com example.com is reserved for documentation by RFC 2606; it accepts no mail for anyone
Website https://example.com/u/482 the same reserved domain, so a link in a test email goes nowhere private
IP address 198.51.100.23 198.51.100.0/24 is one of the three RFC 5737 blocks; no real host is ever assigned one
Card number 4242 4242 4242 4242 Stripe's published test Visa; it works only in a sandbox and cannot pay for anything
Phone a random 10-digit number starting 6 to 9 not safe: see the last section

The Mock Data Generator builds rows like this one, up to 5,000 at a time, as JSON, CSV, SQL or XML.

Emails and links: example.com

RFC 2606 sets aside example.com, example.net and example.org, and the top-level names .test, .example, .invalid and .localhost, for documentation and testing. Nobody can register them. A made-up domain such as testmail.in is not the same thing: it may be unregistered today and bought tomorrow, and from then on every fixture sends its mail to a stranger. So every email and URL the generator writes ends at example.com.

IP addresses: the documentation ranges

RFC 5737 reserves three IPv4 blocks for examples: 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24, 256 addresses each. They are never routed on the public internet, so a firewall rule, a log line or a rate-limit test that uses them cannot block or probe a real machine. A random IP is a different matter: any address outside the reserved blocks may be somebody's live server. The Random IP Generator gives only RFC 5737 addresses.

Card numbers: only the published test cards

A number that passes the Luhn check is not therefore fake. Put random digits behind a real issuer prefix and one day the result is somebody's live card. The Test Credit Card Numbers tool hands out only the 47 numbers that Stripe and Razorpay publish for their sandboxes, read from their pages on 15 Oct 2026, and generates only the expiry and CVV. The Stripe test cards and Razorpay test cards pages list each gateway's own set, including Razorpay's RuPay card 6527 6589 0000 1005.

Files and images with nothing inside

An upload test needs a file of the right size and type, not a real document. The Dummy File Generator writes a valid PDF, JPG, PNG, ZIP, CSV, TXT or BIN of an exact byte count, padded with filler rather than content, and Sample PDF Download has fixed 100 KB to 10 MB files. The Placeholder Image Generator draws a plain block labelled with its own size, so a mockup never borrows a photo of a real face.

Seeds: the same data every time

Random data that changes on every run turns a failing test into a ghost: run nine broke, and the rows that broke it are gone. The Mock Data Generator takes a seed, and the same seed with the same fields gives the same rows on any machine. That keeps a bug reproducible, and it means a repository can hold a seed and a field list instead of a megabyte of sample data.

The limit: phone numbers in India

The United Kingdom keeps a block of 1,000 mobile numbers for drama, 07700 900000 to 07700 900999, that Ofcom will not allocate. We found no such fictional range in India. A generated number in the Indian mobile format, ten digits starting 6, 7, 8 or 9, may well be in use. The Mock Data Generator says so on its page and warns never to dial one. Use such numbers for display and validation only, and point any SMS or OTP test at your own phones or a provider's test mode.

Questions people ask

Is it safe to use example.com in test data?

Yes. RFC 2606 reserves example.com, example.net and example.org for documentation, so nobody can register them and no private inbox sits behind them. A seed file that sends a welcome email to priya@example.com reaches no one. A made-up domain is riskier, because someone can buy it later and receive everything your fixtures send.

Which IP addresses are safe to use in examples?

The three RFC 5737 blocks: 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24, 768 addresses in all. They are reserved for documentation and never routed on the internet, so a test that pings, blocks or logs one cannot touch a real machine. Private ranges such as 192.168.0.0/16 are real addresses on someone's network.

Can a Luhn-valid card number belong to a real person?

Yes. The Luhn check catches typing mistakes; it does not mark a number as fake, and about one random 16-digit number in ten passes it. With a real issuer prefix in front, a generated number can match a live card. Use only the test numbers a gateway publishes, which work in its sandbox and nowhere else.

Why should test data use a seed?

So the same data comes back. A fixture that changes on every run makes a failing test impossible to repeat, because the rows that caused it are gone. With a seed, the same seed and fields rebuild identical rows on any machine, so a colleague can reproduce the bug and the repository needs to store only the seed.

Is there a fake phone number range in India?

We found none. The United Kingdom reserves 07700 900000 to 07700 900999 for drama, but India's ten-digit mobile numbers starting 6 to 9 have no set-aside fictional block. Treat any generated Indian mobile number as possibly real: use it to test display and validation, and never call or message it.

Sources

Checked 15 Oct 2026:

The tools for this