What card test data is

Card test data is a fixed set of sandbox card numbers, expiry dates, security code values, and the responses each one triggers. Payment processors publish these values so a developer can run a checkout, a refund, or a subscription charge end to end without moving real money and without handling a real cardholder account.

Card Test Data V10: Guide on Where to Buy CVV

The v1 label marks the first frozen revision of that set. It means the rows inside were checked against a specific processor API version, and that later changes go into v2 instead of editing v1 in place. A versioned file keeps test results reproducible when two people run the same suite months apart.

card test data v1

Where test card data comes from

Processor sandbox documentation

Stripe, Adyen, Braintree, and similar providers each publish their own test numbers on a documentation page tied to their test environment. Every number maps to one scenario: approval, generic decline, insufficient funds, expired card, wrong security code, or a fraud rule trigger.

card test data v4

Network test numbers

Card networks reserve a small set of numbers for testing. 4111 1111 1111 1111 is the common Visa example. These numbers pass the Luhn check and route to a test host, so no real issuer account is involved.

related article

How to build a v1 test data set

1. Pick the processor sandbox the application will run against.
2. Copy the published test numbers from that processor documentation page into a spreadsheet.
3. Add one row per scenario and name the scenario in a column.
4. Fill in the expiry, security code, and postal code each number expects.
5. Record the response code and message the sandbox returns for that row.
6. Save the file in the repository under a versioned path such as test-data/cards-v1.json.
7. Point the test suite at that file instead of hard coding numbers in test scripts.

How to version the set

1. Freeze v1 after the full suite passes on the target API version.
2. Note the processor API version and the date in a comment or a header field.
3. Create a new file for any added or changed row rather than editing v1.
4. Mark v1 as deprecated once v2 ships and the old API version is retired.

Rules that keep the data safe

• Use published sandbox numbers only. Never paste a live card number into a test file, a ticket, or a chat message.
• Keep test card data separate from production configuration and secrets.
• Treat real cardholder data as out of scope for every non-production environment.
• Review the file when the processor changes its test environment, since numbers do get retired.

Compliance notes

PCI DSS applies to every environment that stores, processes, or transmits cardholder data. A staging server that holds a real number falls inside that scope, which is the main reason test data exists. Sandbox numbers carry no account value, so they stay outside the audit boundary and can sit in a public repository.