Phone Number Verification Generator
Create matched pairs of fictional phone numbers and one-time codes for testing sign-up, login and two-factor flows. Register the pairs as test numbers in your auth provider and run the whole verification path without sending a single real SMS.
| # | Phone (E.164) | Code |
|---|
How to Build a Verification Test Set
From empty fixture to repeatable OTP test in three steps.
Match Your Code Policy
Pick the same code length and character set your app sends, so the test exercises the real input mask.
Generate the Pairs
Each phone number gets its own cryptographically random code, created with the browser's secure random generator.
Export to Your Stack
Copy a Firebase-style test list, a JSON fixture for unit tests, or a CSV for QA spreadsheets.
Where Phone Verification Test Data Pays Off
Every place a code-entry screen needs to be tested without a SIM card.
Real SMS delivery is slow, costs money per message and fails randomly in CI. Predefined number-and-code pairs make verification tests deterministic, which is why most auth platforms let you register them.
- Firebase Authentication Test Numbers: Firebase lets you add fictional phone numbers with fixed codes in the console; paste the generated list to skip real SMS during development.
- End-to-End Tests in CI: Playwright or Cypress runs can type the known code instead of waiting for a message that never arrives in a headless browser.
- Mock SMS Gateways: Seed a local stub that answers verification requests with the stored code for each test number.
- Code Input UX Reviews: Check autofill, paste handling, split digit boxes and alphanumeric keyboards using the exact code format you ship.
- Rate-Limit and Lockout Testing: Use one number per scenario to confirm wrong-code limits, resend cool-downs and lockout messages behave as designed.
- Support Team Training: Show agents what a verification record looks like without exposing a real customer's phone number.
Verification Code Formats Compared
Choose a code length that balances security and usability.
| Format | Possible codes | Typical use | Testing tip |
|---|---|---|---|
| 4-digit numeric | 10,000 | Low-risk confirmations, legacy apps | Test that leading zeros like 0042 are not stripped |
| 6-digit numeric | 1,000,000 | Most SMS OTP and TOTP apps | Check iOS and Android one-time-code autofill |
| 8-digit numeric | 100,000,000 | Banking and high-value actions | Confirm the field is wide enough on small screens |
| 6-character alphanumeric | about 1.07 billion (32 symbols) | Email or voice codes, backup codes | Verify case-insensitive comparison |
| 8-character alphanumeric | about 1.1 trillion (32 symbols) | Recovery and device pairing codes | Make sure 0/O and 1/I are excluded, as here |
The alphanumeric option uses a 32-character set without 0, 1, I and O so testers cannot confuse lookalike characters. Numeric codes keep leading zeros, which is a common source of bugs when codes are stored as integers.
Predefined Test Pairs vs Real SMS Delivery
What changes when the code is known in advance.
Predefined Test Pair
Generated here- Code is known before the test starts
- No carrier, no delivery delay
- Free and unlimited
- Deterministic, so CI runs do not flake
- Works offline and in headless browsers
- Must be registered as a test number in your provider
Real SMS Verification
Live carrier delivery- Code created at request time
- Depends on carrier routing and filters
- Charged per message
- Can be delayed or dropped
- Needs a real SIM or virtual number
- The only way to test actual deliverability
Keeping Verification Test Data Safe
Test numbers with fixed codes are a back door if they reach production.
Safe Practices for OTP Test Pairs
- Restrict test numbers to non-production projects — keep them in development or staging auth configurations.
- Use the code length you ship — a 4-digit test will not catch layout bugs in an 8-digit field.
- Store fixtures with your tests — commit the JSON next to the test that uses it so the data is versioned.
- Rotate codes when fixtures leak — regenerate pairs if a test file is shared outside the team.
- Keep one real-device check — run a final manual test on a real phone before release.
Mistakes to Avoid
- Whitelisting test numbers in production — a fixed code in a live project lets anyone log in as that number.
- Using real people's numbers as fixtures — a test could accidentally send them a code or expose their data.
- Treating fixed codes as a security test — they skip the delivery channel, so they prove nothing about SMS security.
- Bypassing another service's verification — these pairs only work in systems you control and configure.
- Storing codes as numbers — integer columns silently drop leading zeros and break matching.
Tools Showcase
Explore more free, browser-based phone number utility and testing tools.
Temporary Phone Number Generator
Disposable test numbers that expire on a timer you choose.
Phone Number Validator
Check length, country code and type, then normalize to E.164.
Phone Number Email Generator
Carrier email-to-SMS addresses and phone + email test pairs.
Phone Number QR Code Generator
Scan-to-call, scan-to-text and vCard QR codes as PNG or SVG.
Phone Verification Generator FAQs
How test numbers and one-time codes work together.
No. It only creates number-and-code pairs. You register them in your own auth system, which then accepts the code without sending an SMS.
In the Firebase console, open Authentication, go to the phone sign-in provider and add each number with its code under the phone numbers for testing section. The Firebase list view gives you both values side by side.
No. Other services send a real SMS, and these numbers have no phone line to receive it.
With the browser's crypto.getRandomValues, the same secure source used for passwords, so codes are not predictable from one another.
Some apps send letter-and-digit codes for email or voice verification. The character set skips 0, O, 1 and I to avoid misreads.
Yes. Codes like 004219 are kept as text so you can test that your app does not drop the zeros.
E.164, for example +12025550147, which is the format Firebase, Twilio and most SMS APIs expect.
Yes. Download a JSON fixture with phoneNumber and verificationCode fields, or a CSV for spreadsheets and data-driven tests.