Random 4-Digit Code Generator
Generate random 4-digit, 6-digit, or 8-digit numeric codes for OTP testing, 2FA verification flows, SMS code mocks, PIN seeders, and any QA scenario that needs disposable numeric tokens. Leading zeros preserved. Free REST API with no signup.
Clique em Gerar para começar
Clique em Gerar para começar
Clique em Gerar para começar
When to use a random numeric code
One-time passwords (OTP), two-factor authentication codes (2FA), SMS verification numbers, email confirmation tokens, voicemail PINs, and account recovery codes all use short numeric strings as their wire format. When you build or test those flows, you need fixture data that looks identical to what your provider will send. Hard-coding "1234" in tests creates collisions; using real OTPs from production providers is slow and unauditable. A deterministic generator gives you the right shape, every time.
Why 4, 6 and 8 digits
- 4 digits — legacy SMS OTPs, voicemail PINs, low-stakes app unlock codes. 10,000 possibilities, brute-force risk if no rate limit. Common in older banking apps, hotel safes, and SIM PINs.
- 6 digits — modern standard. RFC 6238 TOTP (Time-based One-Time Password) defaults to 6 digits. Used by Google Authenticator, Authy, Microsoft Authenticator, Stripe 3DS, and most banking 2FA. One million possibilities, 30-second window.
- 8 digits — high-entropy backup codes, account recovery, sensitive admin flows. 100 million possibilities. Often grouped as XXXX-XXXX for readability.
REST API for automated testing
Use the REST API to seed test fixtures, mock SMS providers, or load-test OTP validation endpoints:
# Generate 100 random 4-digit codes
curl "https://fakeforge.com.br/api/generate?type=random4&quantity=100"
# Generate 6-digit TOTP-shaped codes for load testing
curl "https://fakeforge.com.br/api/generate?type=random6&quantity=1000"
# Bulk export as JSON for a Postman or Playwright fixture
curl "https://fakeforge.com.br/api/generate?type=random8&quantity=500" \
-o backup-codes.jsonFree tier: 100 requests per day, up to 10,000 codes per call. No signup, no API key required.
Important: not cryptographically secure
These codes use JavaScript's Math.random(), which is fine for test fixtures and mock data but is not safe for real authentication tokens. For production OTP, TOTP, or session secrets, use crypto.randomInt() (Node) or window.crypto.getRandomValues() (browser). This tool exists for the QA / staging layer only.