What test card numbers are and why developers use them
Test card numbers are fake credit card numbers that payment processors and card networks provide for developers to use in sandbox environments — isolated testing spaces that mimic real payment systems without moving actual money. They let you build and test checkout flows, payment forms, and transaction logic before your code touches a live payment system.
Every major payment processor — Stripe, Square, PayPal, Adyen, and others — publishes its own set of test numbers. These numbers pass basic validation checks (they satisfy the Luhn algorithm, which is the mathematical rule credit cards follow) but are flagged by the processor as test-only. If someone tries to use a test card number in a real transaction, the payment will decline.
Test cards are not the same as real cards, and they carry no financial risk. You cannot accidentally charge anyone. They exist solely to let you verify that your payment form works, that your error handling catches declined cards, and that your success page displays when a payment goes through.
Key Takeaways
- Test card numbers are fake numbers provided by payment processors for use only in sandbox or development environments, and they will always decline in live payment systems.
- Each payment processor publishes its own set of test numbers, and you must use the numbers that match the processor you are testing with.
- Test cards let you verify checkout flows, error messages, and transaction logic without risking real money or customer data.
- Common test scenarios include successful charges, declined cards, expired cards, and cards that trigger fraud checks — each with its own test number.
- Test card numbers are public information and appear in official processor documentation; using them in development is standard industry practice.
How payment processors organize test card numbers
Payment processors group test cards by outcome. A successful charge uses one test number. A declined card uses another. A card that triggers a 3D find authentication check uses a third. This structure lets you test the full range of responses your code might encounter.
Stripe, for example, publishes test numbers for Visa, Mastercard, American Express, and Discover, with variants for each outcome type. The number 4242 4242 4242 4242 (with any future expiration date and any three-digit CVC) always succeeds. The number 4000 0000 0000 0002 always declines with a "card_declined" error. Square and PayPal follow similar patterns with their own number sets.
The expiration date and CVC on a test card can be anything — 12/99 and 999 are common choices — because the processor is not validating those fields the way it would with a real card. What matters is the card number itself, which tells the processor which test scenario to simulate.
Where to find test card numbers for your processor
Test card numbers live in the official documentation of the payment processor you are using. Stripe publishes them in its Testing guide. Square lists them in its Testing Overview. PayPal includes them in its Sandbox documentation. Adyen, Authorize.Net, and Braintree all maintain similar pages.
Do not rely on test card numbers from third-party websites or forums. The numbers themselves are stable and public, but documentation changes, new test scenarios are added, and outdated information can lead you down the wrong path. The processor's own documentation is always the source of truth.
If you cannot find test card numbers in your processor's documentation, check whether you are looking at the sandbox or live section. Some processors separate testing docs from production docs, and it is straightforward to land on the wrong one.
Common test scenarios and their card numbers
Most processors provide test numbers for the scenarios you will encounter most often. A successful transaction uses the basic test number. A declined card simulates what happens when a customer's bank rejects the charge — your error handling should catch this and show the customer a message. An expired card tests whether your form validates the expiration date. A card that requires 3D find (also called Strong Customer Authentication or SCA) tests whether your checkout can handle the extra authentication step.
Some processors also provide test numbers for specific decline reasons: insufficient funds, lost card, stolen card, or processing error. These let you verify that your code handles different failure modes correctly. If your checkout shows the same generic error message for every decline, you have not tested thoroughly enough.
The specific test numbers vary by processor. Stripe uses 4000 0000 0000 0002 for a generic decline. Square uses 4111 1111 1111 1111 for success and 4000 0000 0000 0002 for decline. PayPal uses different numbers in its Sandbox environment. Always cross-reference your processor's documentation to find the exact number for the scenario you are testing.
How to use test cards in your development environment
Using a test card is straightforward: enter the test number into your payment form just as you would a real card number, use any future expiration date, and use any three-digit CVC. Submit the form. The processor will simulate the transaction and return the result you specified with that test number.
Your code should handle both success and failure. When a test card succeeds, your checkout should record the transaction ID (also called a charge ID or transaction reference), store it in your database, and show the customer a confirmation page. When a test card declines, your code should catch the error, display a message telling the customer the card was declined, and let them try again with a different card.
Test your error messages. If your code shows "An error occurred" for every failure, you have not tested enough. Real error messages — "Your card was declined" or "Your card has expired" — help customers understand what went wrong and how to fix it.
Security and best practices when testing with card numbers
Test card numbers are public information. They appear in official documentation and in countless development guides. There is no security risk in using them, and you should never treat them as secrets. Do not commit them to version control with special handling or environment variables — they are not credentials.
What you should protect is your actual processor API key or secret key. That is the credential that lets you charge real money. Keep it out of version control, out of client-side code, and out of any public repository. Test cards have no such restriction because they cannot be used to move real money.
When you move to production, your code will use real card numbers submitted by real customers. The payment processor will validate those numbers against real banks and real card networks. Test cards will no longer work — they will decline when ready. This is by design and is the final safety check that prevents test data from leaking into live transactions.
Frequently Asked Questions
Can I use test card numbers in a live payment environment?
No. Test card numbers are flagged by the processor and will always decline in live mode, even if you use the correct expiration date and CVC. This is intentional — it prevents test data from accidentally processing real charges. You must use real card numbers in production.
Do I need different test cards for different payment processors?
Yes. Each processor publishes its own set of test numbers. Stripe test cards will not work with Square, and PayPal test cards will not work with Adyen. Use the test numbers that match the processor you are integrating with, found in that processor's official documentation.
What happens if a customer accidentally enters a test card number in my live checkout?
The payment will decline with a generic error. The customer will see a message that their card was declined and can try a different card. No charge will be processed, and no data will be stored. Test cards are safe in this scenario.
Are test card numbers the same across all countries?
Most test card numbers work globally, but some processors provide region-specific test cards for testing local payment methods or regional compliance rules. Check your processor's documentation to see whether your region requires special test numbers.
Can I test with real card numbers in a sandbox environment?
No, and you should not. Sandbox environments are isolated from live payment systems, but entering real card numbers anywhere — even in a sandbox — is a security risk and violates payment card industry standards. Always use test card numbers in development and sandbox environments.