An expiry date test card is a sandbox card number that you pair with a future expiration date to check how a checkout reads the MM/YY field. Test card numbers come from payment processors, work only in test mode, and link to no real account. The date matters in two cases: confirming that a valid future expiry passes, and confirming that a past expiry gets declined.

test card expiry

Key facts at a glance

• Test cards are free and published in processor documentation.
• Most generic test cards accept any future month and year.
• Past dates should fail, either in your form or at the gateway.
• Test numbers pass the Luhn check but are tied to no account.

Do test cards need a real expiration date?

No. A test card is a number string that a processor maps to a sandbox response, so no billing cycle and no issuing bank sit behind it. Stripe's standard test card, 4242 4242 4242 4242, takes any future expiry, any three-digit CVC, and any postal code.

Card Expiry Validation Guide

Other processors publish the same style of list. Some pin a fixed expiry to a specific scenario, such as an expired-card decline. Read the table for the processor you use, because the rules differ.

card expiry validation

Which expiry date should you type in a test?

Pick a month at least two years out, such as 12/34. A far-future date keeps your test scripts and notes valid for a long time. If you test card-on-file logic, add a second card with a date close to the current month so you can watch a renewal reminder fire.

related article

How expiration fields are validated

A card form checks the expiry in three places: the browser, your server, and the processor. Each layer can stop a bad date before the next one sees it. Knowing that order tells you where a bug lives.

• Browser: masks the input, blocks a past month, checks for two digits.
• Server: re-checks the value, since client code can be bypassed.
• Processor: applies its own rules and returns a decline code such as expired_card.

Format matters at every layer. Send MM/YY with a leading zero on single-digit months.

How to test expiration validation on a checkout

1. Open your sandbox or test mode, never live mode.
2. Enter a published test number such as 4242 4242 4242 4242.
3. Enter a future expiry (12/34), any CVC, and any ZIP code.
4. Submit and confirm the payment returns an approval.
5. Repeat with a past date such as 01/20 and confirm the decline.
6. Try invalid input: month 13, month 00, a two-digit year, and a blank field.
7. Check that your error message names the field and that no card data is stored after a failed attempt.

Steps 5 and 6 test your own code more than the processor. Many gateways never see a past date because the form blocks it first.

Expiry scenarios worth covering

• Valid future date: expect approval.
• Past date: expect a form error or a gateway decline.
• Current month: expect approval, because a card is valid through the last day of its expiry month.
• Month 00 or 13: expect a form error.
• Date within 30 days: expect a renewal or reminder trigger if you support saved cards.

Where do test card numbers come from?

Every major processor publishes a test card table in its developer docs. Stripe, Adyen, Braintree, Authorize.net, and Square all list numbers for approvals, declines, and edge cases such as expired cards. The lists are free and public.

Be careful with any site that sells test cards, CVV values, or card data. A real card number with a real expiry is not a test card, and buying or using one is card fraud. Test numbers have no owner, no balance, and no value outside a sandbox.

Common mistakes

• Typing an expired date on a generic test card, then blaming the processor for the decline.
• Running test numbers against a live endpoint and expecting them to work.
• Hardcoding 12/23 in a test suite that then breaks when the date passes.
• Assuming every processor returns the same decline codes for the same input.
• Skipping month-end checks, when a card that expires this month can behave in more than one way.

Frequently asked questions

Does 4242 4242 4242 4242 expire?

The number itself does not expire. It stays valid in test mode as long as the processor keeps publishing it. The expiry you type still has to sit in the future, because your own form or the gateway checks that rule.

Can I use any CVC with a test card?

Yes, for most generic test cards. Any three digits work, and some processors accept a four-digit code on their American Express test numbers. Use the value your processor lists for decline scenarios.

Why does my gateway reject the expiry date?

Two common reasons: the date is in the past, or the format is wrong. Send MM/YY with a leading zero and a two-digit year unless the API spec says otherwise. A reversed format such as YY/MM fails on most validators.

Are test card numbers the same at every processor?

No. A few numbers, like 4242 4242 4242 4242, appear in several lists because they trace back to shared industry test data. Decline codes and edge-case numbers differ by processor, so copy them from the docs for your gateway.

Key takeaways

Use a future expiry with any published test card, and use a past expiry when you want to prove the decline path works. Keep test numbers out of live mode and treat any vendor who sells real card data as a fraud risk. That covers the whole job of an expiry date test card.