A privacy-first browser utility for generating synthetic account data and permitted disposable-email test inboxes.
Live demo · Report a bug · Request a feature
- About the Project
- Tech Stack
- Getting Started
- Usage
- API Reference
- Project Structure
- Features and Roadmap
- Testing
- Deployment
- Contributing
- Security
- License
- Acknowledgments
- Footer
FAKE_IDENTITY is a client-only HTML, CSS, and JavaScript application for generating synthetic account data during development, quality assurance (QA), demos, and privacy-conscious testing. It keeps the workflow in the browser, avoids application API keys, and makes the limits of temporary email, phone, and payment data explicit.
The app requests a synthetic person from Random User API, falls back to FakerAPI when the primary service is unavailable, and finally uses a local synthetic generator so the interface remains usable offline. It can also create disposable inboxes through Mail.gw, make an optional direct Mail.tm API attempt, or open 10MinuteMail as an official web-only provider.
- Generates names, usernames, genders, dates of birth, addresses, and placeholder email addresses from a real free synthetic-data service.
- Supports United States, United Kingdom, Canada, Australia, Germany, and France identity regions.
- Creates and polls Mail.gw disposable inboxes in the browser without an application key.
- Provides Mail.tm as an additional API provider, with an honest status when browser CORS prevents direct access.
- Opens 10MinuteMail as a web-only provider because the service does not publish a public inbox API.
- Persists the current synthetic record and disposable-email credentials in browser
localStorageso refreshes do not immediately discard a test session. - Includes one-click field copying, JSON export to the clipboard, service-status indicators, timeouts, loading states, and safe rendering of received message text.
- Generates local account passwords at 12, 16, 20, 24, or 32 characters using the browser’s cryptographically secure random source when available.
- Shows an estimated entropy value, strength level, character composition, and accessible progress feedback for each generated password.
- Provides a dark/light theme toggle with an accessible label and browser-local preference persistence.
- Generates a safe bookmarklet launcher that opens the deployed app in a new tab without inspecting or modifying the current page.
- Uses test-only phone and payment values. It does not intercept SMS, provide real payment credentials, automate sign-ups, or bypass verification.
flowchart LR
Browser[Static browser app\nHTML + CSS + JavaScript]
Identity[Random User API]
Faker[FakerAPI fallback]
MailGW[Mail.gw API]
MailTM[Mail.tm API]
TenMinute[10MinuteMail website]
Storage[Browser localStorage]
Browser -->|GET synthetic person| Identity
Browser -.->|fallback| Faker
Browser -->|domains, account, token, messages| MailGW
Browser -.->|optional direct provider| MailTM
Browser -->|open official web-only inbox| TenMinute
Browser -->|save current test session| Storage
This project is for synthetic data, permitted QA, demonstrations, and privacy protection where the destination service accepts disposable email. Do not use it to impersonate a person, create fraudulent accounts, bypass identity or phone verification, evade abuse controls, intercept public SMS, or access a service without authorization. Each external provider has its own terms, availability, retention, and acceptance policies.
| Area | Verified technology or service | Evidence |
|---|---|---|
| Frontend | Static HTML, CSS, and browser JavaScript | index.html, style.css, and app.js |
| Runtime tooling | Node.js and npm-compatible npx |
package.json scripts |
| Local server | serve invoked through npx |
npm run dev |
| Identity data | Random User API, FakerAPI fallback | URLs defined in app.js |
| Disposable email | Mail.gw, Mail.tm, and 10MinuteMail website | Provider registry in app.js |
| Browser storage | localStorage |
Persistence functions in app.js |
| Password generation | Web Crypto API with a fallback | crypto.getRandomValues is used when available; generated passwords stay in the browser |
| Theme preference | Browser localStorage |
The theme toggle saves dark or light locally |
| Bookmarklet launcher | Native browser bookmarklet URL | Opens the deployed Vercel app in a new tab; it does not inject page code |
| CI validation | GitHub Actions on Ubuntu with Node.js 22 | .github/workflows/validate.yml |
| Database or backend | None | The repository contains no server or database code |
| Deployment | Existing live URL is hosted at Vercel | Repository homepage metadata |
The project has no lockfile, server-side environment variables, database migrations, Dockerfile, or framework-specific build step. The package version is 1.0.0 and the package name is dev-data-generator.
Install Node.js with npm available on your command line. The repository does not declare a minimum Node.js version; the validation workflow uses Node.js 22. No API key, database, or account configuration is required for the application itself.
Clone the repository and enter its directory:
git clone https://github.com/vincenzo-afk/FAKE_IDENTITY.git
cd FAKE_IDENTITYThe project has no dependency manifest beyond its built-in npm scripts, so there is no required install step. Start the local static server with:
npm run devOpen the local URL printed by serve. Running through a local server is recommended rather than opening index.html directly because browser security policies can restrict external requests from file:// pages.
The application has no .env file and reads no environment variables. External requests use public provider endpoints directly from the browser. The provider selector in the interface controls which disposable-email path is used.
The current synthetic identity and any generated disposable-email credentials are saved in browser localStorage under an app-owned key. The selected theme is stored separately under an app-owned theme key. Use Clear local data to remove generated account data from the current browser; the theme preference is intentionally preserved. Clearing local storage does not remotely delete an inbox already created with an external provider.
Start the app with npm run dev, then choose an identity region and select Generate Identity. The identity card displays the synthetic record returned by the active identity source. The status pill identifies whether Random User API, FakerAPI, or the local fallback supplied the data.
Choose a disposable-email provider in the Contact Details card. Mail.gw creates an in-app inbox and polls for messages. Mail.tm uses the same free account/token/message workflow when its browser CORS policy permits the request. 10MinuteMail opens the official website in a new tab because it is a web-only service in this integration.
Use the copy buttons for individual fields or Copy All JSON for the complete current record. In Account Password, choose 12, 16, 20, 24, or 32 characters and select Generate password to replace the locally generated password. The strength panel estimates entropy from password length and the character categories present, then displays Weak, Fair, Strong, or Very strong feedback. Use the Light mode or Dark mode toggle in the toolbar to switch themes; the selected theme is saved in this browser. Use Clear local data when the test session should be removed from the current browser.
The Bookmarklet launcher creates a standard javascript: bookmarklet for the deployed app. Copy the generated code into a new browser bookmark, or drag Drag to bookmarks to the bookmarks bar. Running it only calls window.open for https://fake-identity-chi.vercel.app/?launcher=bookmarklet; it does not read, scrape, inject into, or auto-fill the page where it is activated. For local development, update the APP_URL constant in app.js before generating a local launcher.
| Selection | In-app address | In-app inbox | Expected behavior |
|---|---|---|---|
| Mail.gw | Yes | Yes | Recommended default for this static app. |
| Mail.tm | Yes, if allowed by CORS | Yes, if allowed by CORS | The UI reports failure when the provider blocks the browser origin. |
| 10MinuteMail | Created on the provider website | No public API integration | Opens the official web inbox in a new tab. |
The displayed phone number is synthetic and not SMS-capable. The displayed card is the fixed Visa test value 4242 4242 4242 4242 with expiry 12/34 and CVV 123; it cannot charge a card and must only be used in a compatible sandbox.
FAKE_IDENTITY does not expose a server API. It is a static browser application that calls the following external services directly.
| Method | External endpoint | Purpose | Authentication |
|---|---|---|---|
GET |
https://randomuser.me/api/ |
Generate one synthetic identity record | None |
GET |
https://fakerapi.it/api/v2/persons |
Secondary synthetic identity source | None |
GET |
https://api.mail.gw/domains?page=1 |
Find an active disposable-email domain | None |
POST |
https://api.mail.gw/accounts |
Create a disposable-email account | JSON address and password |
POST |
https://api.mail.gw/token |
Obtain a bearer token for the created account | JSON address and password |
GET |
https://api.mail.gw/messages?page=1 |
Poll messages in the current inbox | Bearer token |
GET |
https://api.mail.tm/domains?page=1 |
Find an active Mail.tm domain | None |
POST |
https://api.mail.tm/accounts |
Attempt Mail.tm account creation | JSON address and password |
POST |
https://api.mail.tm/token |
Attempt Mail.tm token creation | JSON address and password |
GET |
https://api.mail.tm/messages?page=1 |
Attempt Mail.tm inbox polling | Bearer token |
GET |
https://10minutemail.com/ |
Open the web-only temporary inbox | Provider website session |
Requests use browser fetch, an AbortController timeout, and response-shape checks. The application reports service failures in the UI rather than returning fabricated live-inbox data.
FAKE_IDENTITY/
├── .github/
│ ├── PULL_REQUEST_TEMPLATE/
│ │ └── pull_request.md # Pull-request checklist
│ └── workflows/
│ └── validate.yml # JavaScript and whitespace validation
├── .gitignore # Local secrets, dependencies, and generated files
├── CONTRIBUTING.md # Development and pull-request guidance
├── SECURITY.md # Vulnerability reporting and security boundaries
├── CODE_OF_CONDUCT.md # Community behavior expectations
├── app.js # API adapters, UI state, persistence, and polling
├── index.html # Application markup and accessibility labels
├── package.json # Project metadata and npm scripts
├── style.css # Responsive visual design and status styles
└── README.md # Project documentation
- ✅ Synthetic identity generation with region selection.
- ✅ Random User API primary source with FakerAPI and local fallback paths.
- ✅ Mail.gw in-app disposable inbox support.
- ✅ Mail.tm optional direct API support with visible CORS failure handling.
- ✅ 10MinuteMail official web-only handoff.
- ✅ Browser-local persistence and explicit data clearing.
- ✅ Per-field copying and JSON clipboard export.
- ✅ Test-only phone and payment data clearly labeled in the UI.
- ✅ Configurable local password generator with browser cryptographic randomness.
- ✅ Estimated entropy and password-strength feedback with accessible progress semantics.
- ✅ Persistent dark/light theme toggle with accessible state labels.
- ✅ Safe bookmarklet launcher with copy and drag-to-bookmarks instructions.
- ✅ GitHub Actions syntax and whitespace validation.
- Disposable-email acceptance depends on the destination site and provider availability.
- Mail.tm may be blocked by browser CORS policy in a static deployment.
- 10MinuteMail cannot be polled in-app without a supported public API.
- The project has no automated browser test suite or server-side proxy.
- The repository does not currently include a release process or versioned changelog.
Run the repository’s deterministic validation command:
npm run checkThis executes node --check app.js and validates JavaScript syntax. Check whitespace changes before committing:
git diff --checkThe GitHub Actions workflow runs both commands for pushes and pull requests targeting main. There is no test framework, test directory, or coverage configuration in the repository.
For service changes, manually verify the following in a browser: identity generation, switching identity regions, provider selector changes, Mail.gw error and success states, Mail.tm failure reporting when CORS blocks it, 10MinuteMail handoff behavior, local-data clearing, copy controls, and responsive layout.
The application is already associated with the live URL fake-identity-chi.vercel.app. No deployment configuration file is stored in this repository, so deployment settings cannot be fully reproduced from source alone.
Because the project is static, it can be deployed to any host that serves index.html, app.js, and style.css over HTTPS. A deployment must allow browser requests to the external provider endpoints; provider CORS policies remain outside the application’s control.
For a local production-like check, serve the repository directory with the same static command used for development:
npm run devRead CONTRIBUTING.md before opening a pull request. Contributions should use focused branches, run npm run check and git diff --check, and document any external-service behavior that changed.
Do not commit access tokens, personal data, real payment information, or provider credentials. Any feature involving disposable email must preserve the project’s privacy-first boundary and must not automate unauthorized sign-ups, bypass verification, intercept SMS, or evade abuse controls.
Read SECURITY.md for the reporting path and supported-branch policy. The application is client-only and does not provide a server-side secret store. It stores generated values, generated passwords, and disposable-email credentials in browser localStorage; users should clear local data when a session is no longer needed. The password generator uses crypto.getRandomValues when available, but generated passwords should not be reused for important personal accounts. The strength meter is an estimate based on length and observed character categories, not a guarantee against password-cracking techniques or breached-password reuse.
Never paste API tokens, passwords, real identity documents, or real payment details into this application. The bookmarklet is intentionally non-invasive: it only opens the trusted deployed app and must not be extended to inspect or manipulate third-party pages. Temporary inboxes are external resources with provider-defined retention and privacy policies.
No LICENSE file is currently present in the repository. The project’s licensing terms should be added by the repository owner before the code is redistributed or reused outside the repository.
FAKE_IDENTITY uses Random User API, FakerAPI, Mail.gw, Mail.tm, and 10MinuteMail as external services. Their availability, terms, and retention behavior are independent of this repository.
The current Git history contains commits attributed to vincenzo-afk and BHARANI KUMAR S. The repository owner is vincenzo-afk.
Project: github.com/vincenzo-afk/FAKE_IDENTITY · Demo: fake-identity-chi.vercel.app
Built for privacy-conscious development and permitted testing by vincenzo-afk.