What CVV Do You Use in Razorpay Test Mode?

Use any three-digit number. Razorpay test mode does not validate the CVV against an issuer, so 123 works, and so do 456, 000, or 999. The value 123 is the convention in Razorpay's own sample code and in most sandbox environments, which makes it the safest default when you are writing test cases.

read more

If you are testing a card network that uses a four-digit code, such as American Express, enter any four digits instead. The field length follows the network, not the sandbox.

razorpay test cvv vs worldpay

Test Cards That Pair With the Test CVV

The CVV is only one field in the payment form. You also need a card number that Razorpay recognizes as a test instrument, plus any future expiry date such as 12/30.

razorpay test cvv vs checkout.com

  • Visa, charge succeeds: 4111 1111 1111 1111
  • Mastercard, charge succeeds: 5267 3181 8797 5449
  • Expiry date: any date in the future
  • CVV: any three digits, with 123 as the usual choice

Razorpay also publishes a second set of test numbers that force specific outcomes, such as insufficient funds or a declined authorization. Those numbers come with their own documented behavior, so pull them from the test card list rather than guessing at the pattern.

Razorpay Test CVV vs Authorize.Net: Comparison Review

Steps to Run a Test Payment

  1. Sign in to the Razorpay Dashboard and flip the account switch from Live to Test Mode.
  2. Open the API keys page for test mode and copy the test Key ID and Key Secret into your staging configuration.
  3. Render the checkout form against the test key so the request hits the sandbox host.
  4. Enter a test card number from the list above.
  5. Enter 123 in the CVV field.
  6. Enter any expiry date later than the current month.
  7. Submit the form and read the response object in your server logs.
  8. Confirm the payment appears in the dashboard under test mode before you repeat the run with a failure card.

Why the CVV Check Does Not Happen

In live mode, the CVV is verified by the issuing bank during authorization. In test mode, no bank is involved. The sandbox simulates the authorization response, which is why an arbitrary CVV returns a success state and why a wrong CVV never produces a mismatch error. If you need to test how your code handles a CVV failure, use a test card that is documented to decline, not a bad CVV on a success card.

Mistakes That Break Test Runs

  • Using a live API key in staging, which routes the request to real authorization.
  • Entering a past expiry date, which the sandbox rejects before it looks at the CVV.
  • Typing a real card number into the test form, even your own.
  • Expecting a CVV mismatch error that the sandbox will never return.
  • Hardcoding the test key in a build that later ships to production.

Handling CVV Data in Live Mode

Once you move to live keys, the rules change. PCI DSS prohibits storing the CVV or any sensitive authentication data after a transaction is authorized, even if it is encrypted. The standard practice is to collect the CVV inside a hosted checkout or tokenization iframe so it never touches your server. Store the token that comes back, never the code the customer typed.