Free Fake User API
200 people who do not exist, for testing a front end.
Uses our serverRequests you make here go to our server. Every tool on this site is the opposite and runs entirely in your browser.
GET /api/users/?limit=3
an example response, rendered when this page was built
{
"users": [
{
"id": 1,
"firstName": "Aaliyah",
"lastName": "Bosco",
"email": "aaliyah.bosco34@example.com",
"username": "aaliyah.bosco34",
"phone": "+1-555-5462",
"age": 60,
"department": "Automotive",
"jobTitle": "International Group Designer",
"company": "Wisoky - Terry",
"city": "Birmingham",
"country": "AR",
"active": true,
"createdAt": "2025-10-03T01:03:23.977Z"
},
{
"id": 2,
"firstName": "Kristy",
"lastName": "Harris",
"email": "kristy.harris61@example.com",
"username": "kristy.harris61",
"phone": "+1-555-2651",
"age": 44,
"department": "Clothing",
"jobTitle": "Forward Configuration Analyst",
"company": "Bergnaum, Champlin and Breitenberg",
"city": "West Mabel",
"country": "KP",
"active": true,
"createdAt": "2024-10-09T10:21:33.291Z"
},
{
"id": 3,
"firstName": "Edgar",
"lastName": "Tremblay",
"email": "edgar.tremblay20@example.com",
"username": "edgar.tremblay20",
"phone": "+1-555-4046",
"age": 33,
"department": "Kids",
"jobTitle": "Customer Solutions Designer",
"company": "Pouros - Little",
"city": "Howellshire",
"country": "WS",
"active": true,
"createdAt": "2025-10-21T01:39:12.894Z"
}
],
"total": 200,
"skip": 0,
"limit": 3
}The endpoints
- GET https://www.shimtools.com/api/users
- GET https://www.shimtools.com/api/users/:id
- GET https://www.shimtools.com/api/health
Everything is GET. Anything else is a 405, on purpose. Responses are JSON, CORS is open so you can call it from a page on any origin, and no cookie is ever set.
Parameters
- limit
- How many to return. 1 to 100, default 30.
- skip
- How many to step over. 0 or more.
- sort
- Field to order by. Must be a real field.
- order
- asc or desc. Default asc.
- select
- Comma separated fields. Each must be a real field.
- q
- Text search across names, email, company and city. 120 characters maximum.
- delay
- Wait before responding, for testing loading states. Up to 10000ms, or 1.5s.
An unusable parameter is a 400 naming the field, never a silent default. Asking for 5000 results and quietly receiving 100 is how somebody pages through the same hundred forever and concludes the API is broken.
What it is for
Building a table, a list or a profile card before the real endpoint exists. Realistic names of realistic lengths are what catch the layout problems: a card that looks fine with Jane Doe and breaks on a hyphenated surname, a column that wraps on a long company name, an avatar that has nothing to fall back on.
The delay parameter is the part with no good free alternative. Loading states, timeouts and retries are written once and then never exercised, because the API answers in twenty milliseconds on a developer machine and the spinner never appears. Ask for a second and a half and it does.
The data is generated from a fixed seed rather than stored, so the same id is the same person every time. That is what makes it usable in a test: an assertion about user 3 keeps passing, and a screenshot of your table stays comparable between runs.
Questions
- Is it really free, and is there a key?
- Free, and there is no key. Every endpoint is open and read only, so there is nothing to sign up for and nothing to lose if a key leaks, because there is no key. Requests are rate limited by address at 60 a minute, which is generous for building a front end and low enough that nobody can use it as free bandwidth.
- Is the data real?
- No, and it cannot become real by accident. The people are generated from a fixed seed, so user 3 is the same person every time and a tutorial written against it stays true. Email addresses use example.com, which IANA reserves precisely so it can never belong to anybody, and telephone numbers use the 555 range, which cannot dial. A fixture dataset that emails a stranger is an incident, so the two things that could cause one are ruled out by construction.
- Why can I not create or delete a user?
- Because a public API that accepts writes has to answer what happens to them, and every answer is bad. Persist them and the shared dataset gets defaced within a day. Discard them and every response is a lie about what was stored. Isolate them per caller and there is now session state, storage growth and an eviction policy to get right. Refusing writes removes that whole class of question, and with it request bodies, which is where injection would have arrived.
- What is the delay parameter for?
- Testing the states a fast API never shows you. A spinner that never appears in development, a timeout that is never reached and a retry that is never exercised are all shipped bugs waiting for a bad connection. Add delay=1.5s and the response takes a second and a half, so the loading state you wrote actually renders. An invalid delay is refused immediately rather than after waiting, and a delay does not buy a larger rate limit.
- Does using this send my data anywhere?
- This page does, because it has to: the tester below makes a real request to our server, and the query string goes with it. That is why this page is not one of the tools. Every tool on this site runs entirely in your browser and nothing you put into one leaves your device, which is checked by the build rather than promised in a policy.