Alternatives to using genuine phone numbers, IP addresses, domain names and email addresses in your training and documentation

A child's phone lying on a desk

If you are preparing training or guidance, showcasing your product or service, or giving code samples, you'll often want example data, such as a phone number, email address, or National Insurance. (I know I do when I do training on data protection and telecoms law.)

You could use something allocated to you, and that's fine as long as you remember to change it when you give it up, and you don't mind someone trying to call you on the number you give out, or adding your email address to spam list because they hate your product.

To avoid this, there's often a temptation to just "make up" some dummy data, and hope that it isn't actually someone's number or domain.

This is a Really Bad Idea. What happens if someone actually use that phone number, IP range, or domain? You're potentially disrupting or annoying them, but, especially if you're popular / have high visibility, there's also a risk of someone adopting it for a nefarious purpose (such as linking to a competitor, or, worse, malware). Neither is great for your reputation.

Fortunately, you're not the first to want to do this, and there's realistic but dummy data specifically, made available specifically for this purpose.

This list covers:

  • UK phone numbers
  • IP addresses (IPv4 and IPv6)
  • Domain names
  • Email addresses
  • Credit cards
  • UK bank account information (including account number, sort code, BBAN, and IBAN)
  • UK National Health Service numbers
  • UK National Insurance numbers

Phone numbers

In the UK, Ofcom has allocated number ranges for use in TV and radio drama programmes.

Although that's their specific purpose, because they are ostensibly valid numbers, but they are not routable over the phone network, they're perfect for other situations too.

I need this often enough that I wrote a phone number generator, which spits out a number suitable for use. Feel free to use it.

(Regulators in other countries may have reserved number ranges for this too — feel free to send me links to official web pages, and I can include them here.)

IP addresses

IPv4

RFC 5737 sets out IPv4 address blocks reserved for documentation:

  • 192.0.2.0/24
  • 198.51.100.0/24
  • 203.0.113.0/24

Because each is a /24, a representation of a single "usable" address is anything between 1 and 254 (.0 and .255 would normally have special meaning in such a subnet, so it's best you don’t use those unless you know why you're using them). So:

  • 192.0.2.1 - 192.0.2.254
  • 198.51.100.1 - 198.51.100.254
  • 203.0.113.1 - 203.0.113.254

For example, 192.0.2.18 is a representation of a single "usable" address, while 192.0.2.399 is not.

IPv6

RFC 3849 sets out IPv6 address prefixes reserved for documentation:

  • 2001:DB8::/32

So you might use:

  • 2001:db8:1e7::/48
  • 2001:db8:1e7:115::/64
  • 2001:db8:1e7:115:403:9457:df8:7902/128 (a single IPv6 address)

(If you're not familiar with IPv6, it's probably best to use a subnet calculator to help you work out a valid address.)

Domain names and email addresses

Domain names

RFC 6761 sets out a number of "special-use domain names".

Of these, some are specifically reserved for use as example domains:

  • example.com
  • example.net
  • example.org

These resolve, and there is a web server run by IANA answering requests to their A/AAAA records, but you can use them without needing to worry who, or what, is at the other end of a request to them.

Note that this is not true for other TLDs. example[.de], for example (intentionally not hyperlinked) is not reserved for use as an example.

You can also use (make up) sub-domains:

  • ns1.example.com
  • mx.example.net
  • www.example.org

Or directories, resources, or pages:

  • www.example.com/blog
  • example.net/photos/20210113/image.jpg
  • https://neil.example.org/.well-known/acme-challenge

Email addresses

Dummy email addresses can be made up using the reserved domains:

  • scooby@example.com
  • sales@example.net
  • brianna@example.org

You get the idea.

The only real downside is that, unlike Ofcom's allocated phone numbers, they look like dummy data.

(If you're tempted to use an email address at one of these reserved domains when a site asks you for an email, obviously, you won't receive anything which the site sends to that address, such as a login code, and many sites will reject these as part of their input validation routine.)

SIP URIs

You can also use the reserved domains for examples of other addressing which uses a domain name. For example, SIP URIs:

  • sip:neil@sip.example.net
  • sip:marketing@example.com;transport=tcp

Credit cards

@privacat got in touch to say that there is a list of credit card numbers suitable for training / documentation / example purposes, on Medium.

It looks like different payment processors have made these available, but I have not attempted to verify this beyond the citations linked in the article.

Thanks, @privacat!

UK bank account information

The European Commerce Banking Service has published these as example data for the UK:

  • Bank account number: 31926819
  • Sort code: 60-16-13
  • BBAN: NWBK60161331926819
  • IBAN: GB29NWBK60161331926819

Here is a list of UK IBAN examples for different banks.

UK National Health Service number

Here are some NHS numbers used in NHS documentation:

  • 485 777 3456 (from here)
  • 450 557 7104 (from here)

UK National Insurance number

This is the official number designated for testing (also shown in the HMRC's National Insurance Manual:

  • QQ 12 34 56 C

Notably, the site says:

avoid using ‘AB 12 34 56 C’ as an example because it belongs to a real person and use ‘QQ 12 34 56 C’ instead