Short answer
Stripe publishes test card numbers for its test mode. The card 4242 4242 4242 4242 accepts any three-digit CVC. American Express test cards use a four-digit CID. Use any future expiry date. Use any five-digit ZIP. These values work only with test API keys, which start with pk_test_ or sk_test_. Live keys reject them.
How test mode works
Stripe splits its API into test mode and live mode. A request signed with a test key goes to a sandbox. It never reaches a card network. No money moves. No bank is contacted. A test card number has no value against a live key, and a live card number has no value against a test key.
Stripe Test Card CVV Code: Any CVC Works in Test Mode
Common test card numbers
- 4242 4242 4242 4242, Visa credit
- 4000 0566 5566 5556, Visa debit
- 5555 5555 5555 4444, Mastercard credit
- 5200 8282 8282 8210, Mastercard debit
- 3782 822463 10005, American Express
- 6011 1111 1111 1117, Discover
- 3056 9300 0902 0004, Diners Club
- 3566 0020 2036 0505, JCB
CVV rules on test cards
For Visa, Mastercard, Discover, Diners Club and JCB test cards, the CVC is any three digits. For American Express test cards, the CID is any four digits. Stripe does not check the value in test mode, so 123 and 0000 both pass. The CVC field exists to test form validation, not to verify a secret.
3D Secure test cards
4000 0000 0000 3220 forces a 3D Secure challenge and completes it. 4000 0000 0000 3063 forces a challenge and fails it. Stripe shows a test authentication page where you pick the outcome.
Stripe Test Card CVV Generator: A Comprehensive Guide
Decline samples
- 4000 0000 0000 0002, generic decline
- 4000 0000 0000 9995, insufficient funds
- 4000 0000 0000 0069, expired card
- 4000 0000 0000 0127, incorrect CVC
What test cards cannot do
A test card cannot create a charge on a live account. Entering 4242 4242 4242 4242 on a live checkout page fails. The number is public. It appears in Stripe's documentation and in millions of public code repositories. A CVC printed next to a test number is a placeholder, not a secret.
Real card data sits under a different rule set. PCI DSS Requirement 3.2 bans storage of the CVV after authorization, even by the merchant that processed the payment. Sale of card data taken from other people is a federal crime in the United States. Test cards are a developer tool, and that is the full scope of their use.