PayPal documents the workflow this data belongs in. Its sandbox is described as a self-contained, virtual testing environment that simulates the live one, and it exists so you can test and debug an integration using fictitious sandbox accounts rather than real PayPal users. Card work inside it still needs addresses. When you take a card through the Orders v2 API, or store one with the Payment Method Tokens API, you send a billing_address on the payment_source.card object, and PayPal hands back the issuer's verdict on it as processor_response.avs_code. Deciding which of those codes you treat as a pass, which you retry and which you decline is your integration's job, and you cannot exercise that logic without a supply of addresses to send it. Fixtures are what that work needs.
The first thing worth knowing is how little PayPal's own API checks. In the published Orders v2 OpenAPI specification, the address_portable schema lists exactly one required property: country_code. Every text field — address_line_1, address_line_2, admin_area_1 for the state, admin_area_2 for the city, and postal_code — carries the pattern ^[\S\s]*$, which matches any string at all, with nothing but a length cap behind it: 300 characters for the street lines and the state, 120 for the city, 60 for the postal code. On a card, billing_address is documented as supporting only those six properties and no others. So the API layer will accept an address that is complete nonsense. Nothing rejects it there.
Validation bites further along, in two different places. Your own checkout form is one: most teams put a real address check in front of the API, and that is the layer that rejects a ZIP belonging to the wrong state. The card's issuing bank is the other. Orders v2 exposes a verification method on the card, with the values SCA_ALWAYS, SCA_WHEN_REQUIRED as the default, 3D_SECURE and AVS_CVV; PayPal describes the last of those as confirming that the address information or CVV included matches what the issuing bank has on file for the associated card. That is a comparison against one cardholder's bank record, not against a postal database — which carries a consequence worth stating plainly: no generated address can produce an AVS match on a real card.
PayPal publishes the response tables, and their shape is the useful part. The Visa, Mastercard, Discover and American Express set is not pass-or-fail but a partial-match report: Y is address plus five-digit ZIP, X is address plus nine-digit ZIP, Z is the five-digit ZIP alone, W the nine-digit ZIP alone, and A the address with no ZIP. N and C match nothing and are declines; E is a decline for a different reason, AVS not being allowed for that transaction type. But G, I, R, S and U mean no answer was available rather than no match — a distinction that catches integrations treating everything that is not Y as fraud. Maestro reports a mostly numeric set instead, 0 through 4 plus U and a null response, and American Express under Website Payments Pro gets its own table that also reports the cardholder name.
This is why the ZIP has to be real rather than five arbitrary digits. The Postal Service hands ZIP ranges to regional post offices, which assign individual codes to delivery routes, so a code carries genuine geography: its first three digits belong to one sectional centre facility, and that facility's service area sits inside a single state in all but a handful of border cases. 42223 at Fort Campbell covers addresses in both Kentucky and Tennessee, and 06390, Fishers Island, is in New York under Connecticut's 063 prefix — so a validator treating the rule as absolute wrongly rejects real addresses. Type 90210 beside New York and any lookup rejects it; type five invented digits and it rejects those too. This generator pins a genuine US city, a five-digit ZIP issued for that city's state, and a NANPA area code from the same region, randomizing both the street name and the house number.
How the generator helps with PayPal sandbox and AVS testing: City, state and ZIP that genuinely agree — the pairing your own form check tests, and the one placeholder data usually fails; Pin a specific US state or city and get a postal code genuinely issued for that place, not a prefix followed by two random digits; Five-digit US ZIP codes, the form the Y and Z rows of PayPal's AVS table describe — there is no ZIP+4 output here; Real NANPA area code for the same region, so the phone field is consistent with the address; Randomized street name and house number, so the address is format-valid while resolving to no real occupant; Bulk export to CSV, JSON or SQL when you need a fixture set rather than a single record; The JSON API accepts a seed, so an API-generated sandbox fixture can be committed alongside the test that uses it..