What is a test expiration date?
A test expiration date is a placeholder expiry value attached to a sandbox card number so developers can simulate payment outcomes without touching a real account. Processors issue these dates for test mode only, and they carry no credit line. Nothing can be charged against them.
Test expiry values follow the same MM/YY or MM/YYYY format as live cards, which lets your checkout form run unmodified during testing.
Card Exp Test Guide: How to Conduct a Secure CVV Check
Why do test cards use a fixed future date?
Processors pick dates far in the future so the sandbox card does not age out of validity. Stripe documents test cards with an expiry such as 12/34 for this reason. A long-dated value means an automated test suite can run for years without a date refresh.
Some gateways accept any future month and year in sandbox mode, while others publish one fixed value per test card brand.
Common test expiration dates by processor
- Stripe: test cards typically use 12/34 or another long-dated future month.
- Braintree: sandbox cards accept any valid future expiry date.
- PayPal sandbox: any future date passes validation in the test environment.
- Adyen: published test cards ship with their own fixed expiry values.
Always pull the current value from your processor's own test card reference before you hard-code it into a fixture. Values change when a sandbox is reset.
How do you test an expired card?
Submit a date from a previous month to simulate an expired card. The gateway returns an expired card decline code that you can map to a specific error message in your checkout.
Pair that test with a declined CVV and an insufficient funds case so your error handling covers the full set of failures.
What validation should your checkout run?
- Confirm the month falls between 1 and 12.
- Confirm the year has two or four digits and is not in the past.
- Run a Luhn check on the card number before submission.
- Require a 3-digit CVV for most brands and 4 digits for American Express.
Client-side validation improves the user experience, but server-side validation must mirror every rule. Anything accepted in the browser can be bypassed.
Test expiration dates versus real card data
Test values exist only inside a sandbox and are rejected by live endpoints. Real card numbers must never be used in a test environment, even briefly.
The PCI DSS standard prohibits storing the CVV or CVC after authorization completes. That rule applies to sandbox and production systems alike.
FAQ
Do test cards ever expire?
No. Sandbox expiry dates are set far in the future, and a reset sandbox issues fresh values. Your test fixtures may still need an update when a processor changes its reference set.
Can a test expiration date be charged?
No. Test mode routes every request to a simulator and no funds move. A live endpoint rejects the same test card number.
What format should an expiry field accept?
Accept MM/YY on the front end and normalize to MM/YYYY before sending it to the gateway. Store only the last four digits and the expiry if your business needs the data for recurring billing.