A sandbox test card is a card number published by a payment processor for use only in its test environment. It behaves like a real card, returning approvals, declines, and authentication challenges, but it never moves money. Developers use it to build and verify a checkout flow before switching to live keys.
How does a sandbox test card work?
Payment gateways run two parallel systems: test mode and live mode. A test card number maps to a simulated account inside test mode, so the gateway returns a scripted response instead of contacting a card network. No issuer is involved, nothing is charged, and no cardholder data is touched.
What are sandbox test cards used for?
- Validating card field formatting, expiry checks, and Luhn validation
- Testing success, decline, and insufficient-funds paths
- Exercising 3-D Secure and strong customer authentication flows
- Verifying webhooks, retries, and refund logic
- Running automated regression suites in CI pipelines
Which test card numbers are commonly documented?
Most providers publish a short table of numbers rather than a single one. Visa's long-standing test number 4242 4242 4242 4242 appears in many docs, alongside 4000 0000 0000 0002 for a generic decline and 4000 0000 0000 9995 for insufficient funds. These strings are public and carry no value because every live gateway rejects them.
Test mode vs live mode: what is the difference?
The API key decides the mode. A secret key prefixed with sk_test_ can only process test cards, and a live key refuses them. That separation is the main safety control: a test card cannot be charged, and a real card cannot be charged while test keys are loaded.
How do you test declines and errors?
Providers expose special card numbers or amounts that force a specific result code. Some gateways return a decline when the charge amount ends in a set value, while others tie the outcome to the card number itself. Copy the exact values from the provider's test data table, since the mapping differs between Stripe, Adyen, PayPal, and Authorize.net.
Are sandbox test cards safe to share?
Yes. Published test numbers are written for public documentation and appear in open-source repos, tutorials, and QA checklists. They are not stolen data and cannot buy anything. A number that works on a live storefront is something else entirely and is not a sandbox card.
Frequently asked questions
Can a sandbox test card be charged for real?
No. The number resolves to a simulated account inside test mode, and a live endpoint rejects it outright.
Why does my test card get declined?
Most often the account is in live mode, the number does not match the provider's table, or the expiry and CVC sit outside accepted test ranges. Use any future expiry date and any three digits unless the docs state otherwise.
Do test cards work for 3-D Secure testing?
Many providers ship dedicated test cards that force a challenge or an authentication failure. The outcome usually depends on the card number, not the amount.
Is a test card the same as a virtual card?
No. A virtual card is a real, issuer-backed number tied to a funding account. A test card exists only inside a sandbox and has no issuer behind it.