Card Test Data Source
Uncover the truth about card test data sources and find the perfect solution for your needs.
Card Test Data Download: Sandbox Card Numbers Explained
A card test data download is a set of fake payment card numbers that developers use to test checkout and billing flows in a sandbox environment. These numbers are published by payment processors, they cannot be charged, and they are never connected to a real cardholder account.
What a test card dataset actually contains
Most processors publish a small table rather than a large file. A typical card test data set includes card numbers, expiry dates, security codes, and the outcome each number is designed to trigger.
- Success cards that behave like a normal approved payment.
- Decline cards that return specific refusal codes, such as insufficient funds or stolen card.
- Authentication cards that force a 3D Secure challenge step.
- Error cards that simulate network timeouts, expired cards, or invalid CVV responses.
The numbers are usually grouped by card brand, so you can test Visa, Mastercard, American Express, and Discover paths without holding a real card from each network.
Where card test data comes from
Test numbers come from the processor whose sandbox you are integrating, not from a marketplace. Each provider maintains its own list and updates it when new payment features appear, such as network tokens or instant payouts.
- Stripe publishes test cards inside its test mode documentation.
- PayPal and Braintree list sandbox card numbers in their developer portals.
- Adyen documents test cards for its test environment.
- Square offers sandbox card numbers for its developer accounts.
Pull the numbers from the provider you actually use. A card that returns an approval in one sandbox may return an error in another.
How to run a card test data download in practice
- Confirm your API keys are set to test mode, not live mode.
- Copy the test numbers into your fixture file or seed script.
- Pair each number with the expiry and CVV listed next to it.
- Write assertions against the response codes you expect for approvals, declines, and errors.
- Rerun the suite after every processor API upgrade.
Keep the dataset in version control with a comment that states it is synthetic. That habit prevents a future maintainer from mistaking test values for live credentials.
Why real card numbers never belong in a test dataset
Real card numbers are regulated under PCI DSS, and storing them outside an approved environment creates legal and financial exposure. Buying, selling, or trading live card data is a criminal offense in the United States and most other countries, regardless of how the data is described. Test numbers exist precisely so that no live cardholder data is ever needed during development.
Common questions
Can a test card be charged?
No. Test numbers are routed to a simulation layer and produce no movement of funds.
Do test cards expire?
Some carry fixed future expiry dates that providers update over time, so recheck the documentation if a test suddenly fails.
Can I use test cards in production?
No. Production keys reject them, and using them outside a sandbox defeats the purpose of the test.