What is a card expiration test?

A card expiration test checks that a payment form reads, validates, and stores the month and year printed on a card. The test passes when the form accepts every date that is still valid and blocks every date that is not.

Test Expiry Card: How to Check Card Expiration Dates in Checkout Code

This is a validation test of your own software, not a check of a card account. A form can reject an impossible date such as 13/28 with no call to a bank.

related article

How does card expiration validation work?

Expiry dates carry two values: a month from 1 to 12 and a year, written as two digits or four. The card stays valid through the last day of that month.

more on this topic

• A card marked 08/27 works from August 1, 2027 through August 31, 2027.
• On September 1, 2027 the same card counts as expired.
• Forms that take MM/YY must map the two digit year to the right century, or a 2099 card will read as 1999.

Expiry dates count as cardholder data under PCI DSS. That means the test covers what the form writes to logs, databases, and error messages, not just the text on screen.

expiry test card

How do you run a card expiration test?

1. Write down the input rules: month 1 to 12, year in MM/YY or MM/YYYY, no blank fields, no dates in the past.
2. Build one test case per rule, plus the boundaries. Include the current month, the month before it, December, and January.
3. Run the cases in a processor sandbox with published test card numbers. Never a live account.
4. Check both layers. A valid date should reach the processor. An invalid date should stop at client validation and server validation.
5. Move the clock. Set the server date to the first and last day of a month to see where the cutoff lands.
6. Log the result. Keep the case, the input, the expected result, and the build number for each run.

Server validation carries the weight. Anyone can edit a request and skip a client side check.

Which test cases catch real bugs?

Most failures come from the edges, not the happy path. Keep this list in the suite.

• Month 00 and month 13.
• February 29 in a year that is not a leap year.
• Letters and symbols, such as ab/25 or 12/2x.
• Whitespace and leading zeros, such as a space before 5/2027 or a typed 05/2027.
• A date one month in the past, one year in the past, and ten years in the past.
• A date far ahead, such as 12/2099.
• Empty fields, single digit months, and a year with three digits.
• Paste events and autofill, which often bypass input masks.

Why does a two digit year cause bugs?

A two digit year needs a century rule. Most teams treat 00 to 49 as 2000 to 2049 and 50 to 99 as 1950 to 1999. Pick one rule, write it down, and test both sides of the split.

Does timezone matter?

Yes. A server in UTC may roll to the next month before the user's local clock does. Decide which clock wins, then test near midnight on the first day of a month.

What are the common failure points?

• String comparison, where 9/27 sorts after 10/27.
• A year stored as four digits but compared as two.
• Validation that runs in the browser and nowhere else.
• A month boundary check that passes expired cards through.
• An expiry date written to a debug log in plain text.

Each of these shows up in production as a failed payment or a support ticket. A suite that covers the month boundary and the year split catches most of them before release.

Which tools help with expiry testing?

Three tools cover most of the work. Browser dev tools show the request and the response. Clock mocking in your test framework, such as freezing system time, handles the date boundary cases. Sandbox test card numbers from your payment processor give you inputs that pass format checks without touching a real account.

Automated suites should run these cases on every build. Manual spot checks miss the month rollover until a customer hits it.

What should you never do when testing card data?

Never test with a card number that belongs to someone else, and never buy card records from a third party seller to use as input. That is card fraud under US law, and it voids a merchant agreement with any processor.

Legitimate test data exists. Processors publish numbers for sandbox use, and those numbers carry the same format rules as live cards. If a vendor offers real card data for sale, treat it as a signal to walk away.

FAQ

Does a valid expiry date prove a card works?

No. The date is one field among several. Approval comes from the issuer, and a date check never confirms funds.

Should a form accept MM/YYYY as well as MM/YY?

Accept both and store one format. Users type what they see on the card, and cards print a two digit year.

What is the last valid day of an expiry date?

The last calendar day of the printed month. A card marked 01/28 works through January 31, 2028.

Can a card expire mid month?

No. Issuers set the cutoff at the end of the month, so treat the whole month as valid.