You need placeholder data behind a real URL: a tutorial, a frontend prototype, a Postman demo, a coding-class exercise. There are half a dozen classic free fake APIs for this — and, because they're free side projects, they break more often than their tutorials admit. One of the biggest (reqres.in) started rejecting every keyless request in 2026; mocky.io is gone entirely.
This page lists the ones worth knowing, what each genuinely does well, where each one stops — and a live up/down badge for each, because we check every service below with a plain keyless GET every 30 minutes from Cloudflare's network (full status page, methodology and bias disclosed there).
| You want… | Use |
|---|---|
| Blog-ish posts/comments/users, read-only, zero setup | JSONPlaceholder |
| Richer datasets (products w/ images, carts, quotes, recipes) | DummyJSON |
| E-commerce demo data with real product photos | FakeStoreAPI |
| Realistic random people (localized names, photo headshots) | randomuser.me |
| Request echo / status-code / delay testing (not fake data) | httpbin or Postman Echo |
| Your own schema, and writes that actually persist | a hosted mock backend |
jsonplaceholder.typicode.com — the original, running since 2014, and still the fastest way to get JSON into a fetch() example. Six resources (posts, comments, albums, photos, todos, users), sane relations, CORS on.
The walls: the dataset is fixed (the same 100 posts for everyone), the six resources are the only ones you get, and writes are faked — POST /posts answers 201 {"id":101}, but GET /posts/101 is a 404. Fine for read-only demos; a dead end the moment your tutorial says "now save it". Full breakdown →
dummyjson.com — the modern favourite: much richer datasets (194 products with images, users, carts, posts, quotes, recipes…), plus built-in ?delay=, an /http/ status-code simulator, and a login endpoint that returns a real JWT. Genuinely the best pick for read-heavy demos.
The walls: same for everyone, fixed schema, and writes are response-only — POST /products/add answers with an id, but the record is never retrievable afterwards. Full breakdown →
fakestoreapi.com — 20 products with real product photographs, carts and users; the default dataset of a thousand React shopping-cart tutorials. The photos are the killer feature for read-only grids.
The walls (all live-verified for our guide): POST /products returns an id whose GET is an HTTP 200 with an empty body (res.json() throws — worse than a 404), ?title= filtering and pagination are silently ignored, and login only works for 10 hardcoded users.
For a decade the go-to for login-flow tutorials (eve.holt@reqres.in is muscle memory for a generation of devs). As of 2026 it requires an x-api-key header on every request — the canonical keyless curl from all those tutorials now returns 401 {"error":"missing_api_key"}. If a course sent you here and you're getting 401s, that's why. What to use instead →
Not a REST backend but a people generator — and a lovely one: localized names in dozens of nationalities, photo headshots, ?seed= determinism. Use it when you need "give me 10 realistic strangers".
The walls: read-only (writes 404), no single-user endpoint, no filtering (?city= is silently ignored), fixed schema. Full breakdown →
Different job: these don't serve fake data, they echo your request back (/get, /status/503, /delay/3). Essential for testing HTTP clients. httpbin.org has had repeated multi-hour 503 outages in 2026 (it's 503ing at the time of writing — check the badge); if it's down, we host a compatible drop-in surface at https://HOST/m/httpbin/get.
Reminders that free tutorial dependencies die: mocky.io (every mock URL in a decade of tutorials now serves a dead TLS certificate), myjson.com (hangs), uinames.com (expired cert), and on the image side via.placeholder.com, placekitten and placeimg are all gone or erroring — see the badges on the status page. When one of these dies, every README that embedded it breaks silently.
Every service above shares the same three walls: fixed dataset, fixed schema, writes that don't stick. All three exist for a good reason — the data is shared by everyone — and they disappear the moment the fake API is yours. Try the shared Mockbird demo right now (writes persist for anyone until the daily reseed):
curl 'https://HOST/m/demo/products?limit=2&select=name,price'
curl -X POST https://HOST/m/demo/products \
-H 'content-type: application/json' \
-d '{"name":"My Widget","price":9.99}'
# → {"name":"My Widget","price":9.99,"id":31}
curl https://HOST/m/demo/products/31 # it's really thereOr get your own private one — one curl, no signup, your schema, 10k requests/day:
curl -X POST https://HOST/api/projects \
-H 'content-type: application/json' -d '{"preset":"ecommerce"}'
# → live seeded products/orders/customers/reviews API + admin keyYou get json-server-style filters and pagination, relations, GraphQL, a login endpoint that issues real JWTs, request inspection, OpenAPI/Postman/TypeScript exports, and CSV in/out — the docs cover everything, or use the dashboard if you'd rather click than curl.
The badges above are fetched live from /status.json. Every 30 minutes we issue a plain keyless GET to each service's canonical URL from Cloudflare's network and record the verbatim result; "up" means an HTTP 2xx/3xx within 8 seconds. Per-service history lives at /status. We run a competing service and say so — which is exactly why the checks are keyless, boring, and inspectable.