You do not need to buy a PayPal sandbox test card. PayPal issues test card numbers free inside the Developer Dashboard, and any seller charging for a "sandbox card list" is reselling credentials you can generate yourself in a couple of minutes. Sign in to your PayPal developer account, open Sandbox Accounts, and view the linked test cards on the account you plan to test with. Use those numbers for checkout testing, keep them out of production code, and treat every other source as unverified.
paypal sandbox test virtual card
What a sandbox test card is for
PayPal runs a separate test environment where merchants simulate payments without moving real money. A test card is a number the sandbox recognizes, so you can push an order through checkout, trigger approve and decline paths, and confirm that your success, failure, and retry pages render the way you expect. The number is not tied to a real account and cannot be charged. It exists to exercise code, nothing more.
PayPal Test Account and Test Card Creation: What Works and What Does Not
What to look for in a source of test cards
- Issued from your own developer account. The number should appear in the Sandbox Accounts panel under the account you are testing, so it stays linked to that account's country and currency settings.
- Brand coverage that matches your checkout. You want at least one Visa, one Mastercard, and one American Express number so you can see how your form handles different card lengths and CVV field sizes.
- Negative testing controls. A usable sandbox lets you force declines, expired-card errors, and AVS or CVV mismatches rather than waiting for a random failure.
- Documentation attached. Numbers that come with a note explaining which response each one triggers are worth far more than a bare list.
- No payment required. Sandbox credentials are part of the free developer tier. A paywall is a signal that the source is unofficial.
Parameter bands to expect
- Length: 15 digits for American Express, 16 for Visa, Mastercard, and Discover, 19 for some co-branded ranges.
- Checksum: a valid Luhn digit, or your client-side validator will reject the number before the request ever reaches the sandbox.
- Expiry: any future date in MM/YYYY form. The sandbox does not check real expiry dates, but the field still has to parse.
- CVV: 3 digits for Visa, Mastercard, and Discover, 4 digits for American Express.
- Billing address: ZIP and country should match the sandbox account, or AVS returns a mismatch and your decline path fires when you wanted an approval.
- Response codes: the sandbox exposes forced AVS and CVV outcomes, so you can test each branch on demand instead of hoping for a failure.
Pitfalls to avoid
- Paying for a list. Every number on a paid list is either free from PayPal or invented by the seller.
- "Live" cards sold as test cards. If a card works against real PayPal checkout, it is not a test card. Buying or selling real card data is a crime in the US and most other jurisdictions, and it carries heavy penalties under card network rules and PCI DSS.
- Mixing environments. A sandbox number will fail in production, and a production credential pasted into test code is a security incident waiting to happen.
- Stale numbers after an account reset. Deleting and recreating a sandbox account can invalidate previously generated cards. Regenerate after any reset.
- Country drift. A card generated for a US sandbox account often declines on a UK or German test account.
- Overusing one card. Hammering a single test number across dozens of accounts can trip rate limits and produce failures that look like bugs in your integration.
FAQ
Where do I get a PayPal sandbox test card?
From the Sandbox Accounts section of the PayPal developer dashboard. Create a business sandbox account, open it, and the linked test cards are listed with their brands and any special behavior.
Can a sandbox test card be charged for real?
No. Sandbox transactions never touch a real funding source. The card number is a placeholder that the test environment recognizes.
PayPal Sandbox Test Credit Card Details: Safe Testing Guide
Why is my sandbox card being declined?
Check three things in order: the card belongs to the account you are testing, the billing country and ZIP match that account, and your negative testing settings are not forcing a decline on that number.
Can I reuse the same test card across projects?
Yes, within the same sandbox account. Across different accounts or countries, generate a fresh one so the linked settings stay consistent.
Do I need a real card to open a developer account?
No. The developer tier is free, and the sandbox exists so you never have to put live payment details into a test flow.