What a sandbox test card is

A sandbox test card is a card number that belongs to a payment provider's test environment. It passes the same validation as a live card, including the Luhn checksum, the expiry date check, and the CVC length check for its brand. It then routes to a simulator instead of a card network. No account is charged. No funds move. No cardholder exists behind the number.

Numbers by provider

Each provider issues its own set. A number from one sandbox does not work in another.

  • Stripe: 4242 4242 4242 4242 for a Visa success. Any future expiry date. Any three digit CVC. Any postal code.
  • Adyen: 4111 1111 1111 1111 for Visa, 5555 4444 3333 1111 for Mastercard, 3700 0000 0000 002 for American Express.
  • PayPal: the developer dashboard generates a card number for each sandbox account. There is no shared public number.

Confirm the current list on the provider's test card page before you debug an integration. Providers add and retire numbers without notice.

Cards that force a decline

Test sets include numbers that fail on purpose, so you can exercise error paths. Stripe examples:

  • 4000 0000 0000 0002: generic decline.
  • 4000 0000 0000 9995: insufficient funds.
  • 4000 0000 0000 0069: expired card.
  • 4000 0000 0000 0127: incorrect CVC.
  • 4000 0000 0000 3220 and 4000 0000 2760 003184: 3D Secure challenge required.
  • 4000 0000 0000 8400 0162 9 style 3DS failure numbers: check the docs for the current value, since this set changes.

Log the decline code, not just the pass or fail result. A decline code such as insufficient_funds maps to a different retry path than card_declined.

Where test cards work, and where they fail

Test cards work when the request carries a test API key or runs in test mode. A test number sent to a live endpoint returns a decline. Providers block 4242 4242 4242 4242 in production for that reason.

Some numbers are shared across many gateways, so a sandbox can reject a number it did not issue. If a test card fails with a validation error and not a decline code, the number is not on that provider's list.

Test cards are not card data

Test numbers carry no CVV record, no billing address, and no issuer. Real card numbers and real CVVs have no role in a sandbox. PCI DSS limits storage of sensitive authentication data after authorization, and a test mode account is still bound by the provider's terms of service.

Checklist before a test run

  1. Confirm the account and the API key are in test mode.
  2. Pick a number from that provider's published list.
  3. Set an expiry date in the future.
  4. Match the CVC length to the brand: three digits for Visa and Mastercard, four digits for American Express.
  5. Record the full response object, including the decline code and the request ID.
  6. Re-run the same case against a decline number to confirm your error handling.