Short answer
A card test data generator creates payment card numbers that pass the Luhn check but belong to no account. Developers use the output in sandboxes, staging servers, and automated tests. Production authorization systems reject these numbers.
What the generator produces
- PAN: 12 to 19 digits. The first 6 to 8 digits form the issuer identification number (IIN), also called the BIN.
- Luhn check digit: a mod 10 checksum digit appended to the body.
- Expiry date: a month and a year, often 1 to 5 years ahead.
- CVV or CVC: 3 digits for Visa, Mastercard, and Discover. 4 digits for American Express.
- Cardholder fields: name, street address, and postal code for AVS checks.
The Luhn step
Start at the rightmost digit of the body and move left. Double every second digit. If a doubled digit is 10 or more, subtract 9. Sum the results. The check digit is (10 - (sum mod 10)) mod 10. A number with the correct check digit passes the Luhn test. The test says nothing about whether the number is issued.
Published test BINs
Processors publish fixed test numbers. Stripe lists 4242 4242 4242 4242 for Visa and 5555 5555 5555 4444 for Mastercard. American Express documents 3782 822463 10005. Discover documents 6011 1111 1111 1117. These strings pass Luhn and route to a test host, not to an issuer. A generator that hard-codes these values matches processor docs. A generator that invents its own BIN range produces numbers that look real and are not.
Card Test Script Generators: What They Are and How Merchants Stop Them
Fields to generate together
A number alone is not enough for a test. Gateways run address verification and CVV checks in the same request. Generate the PAN, the expiry, the 3 or 4 digit code, and the billing address as one record. Store them in the same fixture file so the test suite stays consistent across runs.
Where test data stays valid
Test API keys, mock gateway servers, and CI pipelines accept generated data. Some gateways expose a separate test endpoint that mimics the decline codes of the live host. Keep test credentials in a separate config file from live credentials.
Limits
Luhn validity is not a signal of a live account. A large share of 16 digit strings pass Luhn. A generator that copies real BIN ranges can collide with issued cards. Sending generated PANs to a live authorization endpoint can trip fraud rules and close a merchant account. PCI DSS scope covers test data when it sits on the same system as live cardholder data. Keep the two apart.