A sandbox test card number is a card number published by a payment processor for use in a test environment. It passes format checks and returns a set response. It cannot move real money.
How to Use a Sandbox Payment Test Card for Secure Testing
What a test card number does
A sandbox accepts test numbers in place of live card data. The gateway checks the number, expiry, and security code against rules for test mode. The result is a simulated approval or decline. No issuer is contacted. No funds are reserved.
Test Card for Sandbox Payments: How Sandbox Cards Work
Common published test numbers
- 4242 4242 4242 4242: Stripe test Visa. Any future expiry, any 3 digit CVC.
- 4111 1111 1111 1111: Visa test number used by several gateways.
- 5555 5555 5555 4444: Mastercard test number.
- 3782 822463 10005: American Express test number, 4 digit CID.
Each processor publishes its own list. Do not assume a number from one sandbox works in another.
How to Use a Sandbox Test Card
Fields the sandbox checks
Expiry must be a future date. CVV length must match the card brand: 3 digits for Visa and Mastercard, 4 for American Express. Cardholder name and billing address may be required for address verification tests. Use the test values the processor lists for those fields.
Luhn check and BIN range
Test numbers pass the Luhn checksum. The first digits fall in a real issuer range for the brand. That combination lets a sandbox validate the number without a live lookup. A number that fails Luhn is rejected before any simulated response.
What sandbox numbers cannot do
They cannot authorize a real charge. They cannot test issuer declines that depend on a live account. To test declines, gateways use specific card numbers or specific amounts. Stripe uses 4000 0000 0000 0002 for a generic decline. Check the processor list for decline cases.
Picking a number for a test plan
- Match the brand you support.
- Use the number the gateway documents for the result you need.
- Record the number, expiry, and expected result in the test case.
- Keep test data out of production logs.
Compliance note
Test card numbers are public data. They are not cardholder data. Storing a test number in a sandbox does not create PCI scope by itself. Live card numbers do. Keep the two sets separate.