A Stripe card test tool is a set of fake card numbers that simulate payments inside Stripe test mode. You enter a number such as 4242 4242 4242 4242, add any future expiry date, any CVC, and any billing ZIP, and the charge runs through the same code path as a live payment. No money moves, and the card cannot be charged outside the sandbox.
Stripe built these numbers for developers who need to check checkout forms, subscription billing, refunds, and webhook handling before going live. The numbers are public, permanent, and safe to paste into a README or a support ticket.
How does test mode separate fake cards from real ones?
Test mode is a sandbox that runs on test API keys. Publishable keys start with pk_test_ and secret keys start with sk_test_, and any request signed with them stays inside the sandbox.
The key pair decides the mode, not the card number. Stripe rejects a test card sent with a live key, and it blocks real card numbers in test mode.
Stripe Card Validation Guide for Online CVV Sales
- Test keys: fake charges, fake customers, fake payouts.
- Live keys: real charges, real settlement, real disputes.
- Test data sits in a separate dashboard view you can clear at any time.
Which Stripe test cards cover the main card brands?
Each brand has one number that approves without friction. Use them to confirm your form accepts different card lengths and CVC rules.
- Visa: 4242 4242 4242 4242
- Mastercard: 5555 5555 5555 4444
- American Express: 3782 822463 10005 (four digit CVC)
- Discover: 6011 1111 1111 1117
- Diners Club: 3056 9300 0902 0004
- JCB: 3566 0020 2036 0505
Future expiry dates pass. Any three digit CVC works, except American Express, which needs four digits.
How do you test declines and error codes?
Approval paths are the easy part. Most payment bugs hide in declines, so Stripe ships test cards that fail on purpose and return a specific decline code.
- 4000 0000 0000 0002 returns a generic decline.
- 4000 0000 0000 9995 returns insufficient funds.
- 4000 0000 0000 0069 returns an expired card error.
- 4000 0000 0000 0127 returns an incorrect CVC error.
- 4000 0000 0000 0119 returns a processing error.
- 4000 0000 0000 0341 attaches to a customer, then fails on the first charge.
Decline codes arrive in the API response and in the decline_code field of the error object. Stripe keeps the master list in its testing docs and adds cards as new issuer responses appear, so check that list before you hardcode behavior.
Can the Stripe CLI trigger test events?
The Stripe CLI acts as a local test tool for events that are hard to fake from a browser. The command stripe trigger payment_intent.succeeded creates a test PaymentIntent plus the webhook event that follows it.
Pair it with stripe listen --forward-to localhost:3000/webhook to pipe test events to your local server. That setup lets you rehearse webhook retries, signature checks, and duplicate event handling without writing a script.
How do you test 3D Secure and authentication flows?
Authentication is the step most teams skip. The card 4000 0025 0000 3155 forces a 3D Secure challenge in test mode, and the sandbox shows a modal where you choose authorize or fail.
Test all three outcomes: success, failure, and the case where the customer closes the modal. Each one should map to a different state in your order records.
What about subscriptions and test clocks?
Recurring billing needs time travel, since you cannot wait a month to see renewal behavior. Stripe test clocks let you advance a customer's billing cycle inside the sandbox and watch invoices, retries, and dunning run.
Attach a test card and a test price to a clock, then advance it by days or months. It is the fastest way to check a past due state without touching live data.
What breaks when test mode and live mode get mixed up?
- Live keys in a staging build create real charges on real cards.
- Test keys in production make every checkout fail.
- Hardcoded test cards in a released app reject real customers.
- Webhook endpoints pointed at test data never fire for live events.
Keep keys in environment variables and use a separate webhook secret per mode. A one line config check at boot catches most of these mistakes.
Common questions about Stripe test cards
Do Stripe test cards work on other payment processors?
No. Test numbers are tied to Stripe's sandbox, and other processors publish their own lists with their own rules.
Are test card numbers safe to share?
Yes. They are fake, public, and tied to no account. Real card numbers are a different category: they fall under PCI DSS rules, need encryption and access controls, and belong in a compliant vault.
Can a Stripe test card tell you if a real card is valid?
No. Test mode recognizes its own fixed list of numbers and rejects everything else, so the sandbox says nothing about a real card's status or balance.
Can a test card be used to check a live site?
No. Live mode rejects test numbers. Any flow that needs a working card in production requires real payment credentials from a consenting cardholder.
Checklist before you ship
- Run one approval per card brand.
- Run every decline code your UI claims to handle.
- Confirm webhooks fire once and signatures verify.
- Swap test keys for live keys in the deploy config, and nothing else.