Learning & reference
Guides and references for testing: files, test data and AI evals
31 pages on the parts of testing that are easy to get wrong: evaluation data for LLM apps and agents, test data that can never reach a real person, and how files actually behave across platforms, parsers and HTTP. Most claims come with a downloadable file or a live endpoint, so you can check the behaviour rather than take our word for it. Free, and nothing to sign up for.
AI & LLM Evals
Test data for LLM apps and AI agents: what is generic enough to download, and the files and endpoints to do it with.
Synthetic data for AI evals
Four different things get called eval data. Three are generic and free to download; the answer key for your own app is not. What to reuse, what to build yourself, and where graders quietly lie.
Read the guide →RAG test corpus
Nine documents in six formats, each hiding a fact behind a real extraction trap: columns drawn row by row, a two-row Excel header, text hidden by CSS, Word splitting numbers across runs. With a 15-question answer key.
Download the corpus →JSONL for LLM evals
The file format most eval tools load, a valid sample, and ten deliberately broken variants (BOM, CRLF, trailing commas, duplicate ids, NFD text) to prove your loader fails loudly instead of dropping rows.
Test your loader →Mock API for agent evals
A free, deterministic REST API for testing AI agents and tool calls: paginated records, seeded failures, rate limits, slow and truncated responses, all on demand and identical on every run.
See the endpoints →AI & LLM Test Data
Values reserved so that fixtures, demos and screenshots can never reach a real person, card or server.
Safe test data
The domains, IP ranges, phone numbers and card numbers reserved so your fixtures can never reach a real person, and the kinds of data where no reserved range exists at all.
See the reserved ranges →Synthetic PII for test fixtures
Fake names, emails, phone numbers and cards that cannot reach anyone, why random is not the same as safe, and what that means for data you feed to an AI eval.
Build safe fixtures →Test card numbers
Test numbers for every major card brand, numbers that trigger each kind of decline and each 3D Secure path, and the inputs your own card form has to survive before a processor sees them.
Get the numbers →Test phone numbers
The ranges reserved for fiction in the US and Canada, the UK and Australia, checked against the regulators, plus the formats and characters a phone field must accept.
Get the ranges →Reserved IP addresses
Documentation ranges for examples and logs, special-purpose ranges your code must handle, and the decimal, octal and IPv6 forms of 127.0.0.1 that slip past SSRF filters.
See the ranges →Example domains
Which reserved domain to use for what: .test, .invalid, .localhost and example.com each behave differently when resolved. Why .local and .dev are traps, and email addresses to test a validator with.
Pick a domain →QA test-string library
Unicode, emoji, right-to-left, zero-width, combining marks, SQL/XSS injection and other "naughty strings" to paste into any field to break bad input handling. Copy one string or a whole category.
Open the string library →Testing guides
Guides by kind of app, and for the large files that break uploads, downloads and timeouts.
Web app testing
Point a real browser and a real API at fixtures: file pickers, stalled uploads and downloads, forms, API contracts, JSON number loss, loading and error states, and a run sheet you can finish in an hour.
Work through it →Desktop app testing
What a desktop app meets on a real file system: Windows path limits and reserved names, case and Unicode name rules, files in every encoding, locked files and saving without losing work.
Test the file system →Mobile app testing
What phones do differently: pickers that return content URIs, HEIC photos and EXIF rotation, uploads suspended in the background, and slow, flaky networks with endpoints that misbehave on purpose.
Test on the device →CLI testing
Test a command-line tool the way scripts use it: awkward names and globs, pipes that close early, stdin, exit codes, no terminal, and input text in every encoding.
Test the command line →Large file upload testing
The default upload limits in Cloudflare, nginx, Apache, IIS, PHP and AWS, the MB versus MiB trap that moves a limit by five percent, and exact-size files for both sides of it.
Find your real limit →1 GB test file
Download 500 MB, 1 GB or 2 GB of random data, streamed on demand and identical every time, with a published SHA-256 to prove the download is complete.
Download a large file →10 GB test file
Make a 10 GB file on Windows, macOS or Linux in seconds, and choose between sparse, zero-filled and random data depending on what you are testing.
Make one now →Download speed test files
Incompressible files from 10 MB to 2 GB served from the nearest data centre, the curl command that reports the rate, and how to read the number.
Measure your speed →Formats & Protocols
How files actually behave across platforms, parsers and HTTP.
Filename & path compatibility
Which characters, reserved names (CON, NUL), path separators, trailing dots,
Unicode and zero-byte files break when files move between Windows, macOS and Linux, as a scannable ✓/✗ matrix.
File systems explained
POSIX, NTFS, APFS, ext4, FAT32/exFAT, SMB, NFS and NAS: what each one is, its file-size and path limits, case sensitivity, permissions model, and the gotchas that bite QA and backups.
Compare file systems →File signatures & magic numbers
The extension lies: the first bytes of a file are what identify it. Hex signatures for every format you'll test, the ZIP-family collision trap, byte-order marks, and how to check a file yourself.
See the signature table →Character encodings
Why text turns into café, what a byte-order mark really does, NFC vs NFD and the
duplicate filenames it creates, and why one emoji has a length of 11. With a string inspector and a
test file for every case.
Upload validation checklist
Twelve checks a file upload actually needs, in the order they have to run, each with a downloadable file that proves it. Size limits, magic numbers, zip bombs, Zip Slip, SVG as stored XSS, and where to put the file afterwards.
Work through the checklist →MIME types
The correct Content-Type for every common extension, what nosniff changes,
and the classic mistakes: image/jpg, missing charset, gzip confusion, executable SVG.
HTTP status codes
Every code with the QA note that matters: 401 vs 403, 302 vs 307, 502 vs 504, when 422 beats 400, and how to trigger any status on demand to prove your client handles it.
Browse the status codes →Dates & times
ISO 8601 against RFC 3339, Unix epochs and 2038, Excel serial dates and the 1900 leap-year bug, time zones, daylight saving and the parsing traps between them.
Open the date guide →HTTP headers
The headers that decide whether a file renders, downloads or is refused: Content-Type, Content-Disposition and non-ASCII filenames, Range and 206, caching, CORS and nosniff.
Open the header guide →Regex cheat sheet
Character classes, anchors, quantifiers, groups, lookaround and flags, plus ready-made patterns for email, UUID, IPv4 and slugs, and the traps like greedy matching and catastrophic backtracking.
Open the cheat sheet →Generate test files (CLI)
Copy-paste commands to create a large file, thousands of small files, unique content per file, and checksums, on Windows (PowerShell/CMD), macOS and Linux. Every command has an Explain button.
Get the commands →Crypto & certificates
Self-signed SSL/TLS certificates, PEM/DER/PFX conversion, key and CSR generation, file hashing (SHA-256, SHA-1, MD5, CRC32), encryption with OpenSSL/GPG, and password-protected ZIPs, all explained.
Get the commands →Client-side dev tools
Decode a JWT, format & validate JSON, Base64 encode/decode, hash text, generate UUIDs, convert epoch timestamps and encode URLs: all in your browser, nothing sent to a server.
Open the toolbox →Need the actual files? Every reference here pairs with real, downloadable test files: each with a published SHA-256 and a note on the exact bug it catches.