A test CVV in Stripe is any three-digit code, or four digits for American Express, paired with a Stripe test card number while your account is in test mode. Because test mode never contacts a real card network, Stripe accepts any correctly formatted CVC value and returns a simulated result instead of a real authorization.

Stripe Test CVV Number: A Comprehensive Guide

Why Stripe accepts any CVC in test mode

Test mode is a sandbox. The card numbers you use there are published by Stripe for development, not real accounts, so there is nothing to verify against an issuer. Stripe still runs the same validation rules it applies in production, which means the field must be present and the right length. Beyond that, the value is irrelevant unless you deliberately pick a test card that is designed to return a specific CVC result.

related article

The standard test card and its CVC values

The most widely used Stripe test card is 4242 4242 4242 4242. It succeeds with any future expiry date, any postal code, and any three-digit CVC.

read more

• Visa test numbers: three-digit CVC, for example 4242 4242 4242 4242
• Mastercard test numbers: three-digit CVC, for example 5555 5555 5555 4444
• American Express test numbers: four-digit CID
• Expiry: any date in the future
• Postal code: any value, unless the card is listed as a postal code failure case

The pattern holds for the regional and wallet test numbers Stripe lists as well. If a test card succeeds, the CVC you typed does not change the outcome.

read more

Test cards that simulate a failed CVC check

Stripe also publishes test cards that always produce one specific response, so you can exercise your error handling without guessing. These include cards that return a failed CVC check, cards that return a generic decline, and cards that trigger 3D Secure authentication. In the API response, look at the cvc_check field on the charge or PaymentIntent. It can come back as pass, fail, unavailable, or unchecked, and your application should handle each one differently.

Test keys versus live keys

Test mode is controlled by your API keys. Keys that begin with pk_test_ and sk_test_ stay in the sandbox, while live keys move real money. A common source of confusion is mixing them: a test card submitted with a live key will be rejected by the issuer, and a live card submitted with a test key will not be charged. Keep test keys in your development and staging environments only.

How to verify your CVC handling

1. Validate the length before submission: three digits, four for American Express.
2. Submit a passing test card and confirm the payment succeeds.
3. Submit a card that returns a failed CVC check and confirm your UI shows a useful message.
4. Submit a card that requires 3D Secure and confirm your authentication flow completes.
5. Confirm the CVC is never written to your database after authorization.

Common mistakes when testing CVC

• Assuming the test CVC must match a value stored somewhere. It does not.
• Storing the CVC after the authorization step, which PCI DSS does not allow.
• Testing only the success path and never the failed CVC check.
• Hard-coding a single test card and missing issuer-specific behavior.
• Forgetting to switch keys when moving from test mode to production.

Quick checklist

Use a published test card, accept any well-formed CVC, read the cvc_check field, cover both pass and fail paths, and keep test and live keys separate. That covers everything a test CVV in Stripe is meant to do.