Stripe Test Card Guide: Numbers, Errors, and Safe Testing

What is a Stripe test card?

A Stripe test card is a fake card number that works only in Stripe test mode. A charge built with one routes through Stripe's sandbox, so you can watch your checkout handle approvals, declines, and 3D Secure prompts without moving real money. Stripe publishes these numbers in its API docs, and they cost nothing to use.

Test mode runs on separate keys, usually prefixed pk_test and sk_test. Customers, charges, and subscriptions you create there stay in the sandbox and never appear in your live account. A test card typed against a live key gets rejected.

Which Stripe test card numbers matter most?

Start with 4242 4242 4242 4242. It is the Visa number Stripe documents for a plain successful charge, and it also attaches to a saved customer record.

• 4242 4242 4242 4242: Visa, succeeds. Use it for smoke tests.
• 4000 0025 0000 3155: requires 3D Secure authentication.
• 4000 0000 0000 0002: generic decline.
• 4000 0000 0000 9995: decline for insufficient funds.
• 4000 0000 0000 0069: expired card.
• 4000 0000 0000 0127: incorrect CVC.
• 4000 0000 0000 0119: processing error.
• 5555 5555 5555 4444: Mastercard, succeeds.
• 3782 822463 10005: American Express, 4-digit CVC.
• 6011 1111 1111 1117: Discover, succeeds.

Reach for the decline numbers before launch. A checkout that handles the happy path but breaks on a failed payment will cost you support tickets.

What about 3D Secure test cards?

Stripe keeps a set of cards that force an authentication step, including 4000 0025 0000 3155 and several numbers in the 4000 0000 0000 3xxx range. Use them to see the challenge screen, the redirect, and the return URL in your app. The card you need depends on the 3D Secure version your account uses, so check the Stripe docs list before you build a test plan.

What CVC, expiry, and ZIP should you enter?

Use any 3-digit CVC, any 4-digit CVC for Amex, and any future expiry date. Any billing ZIP works on a standard test charge that succeeds.

• CVC: 3 digits, or 4 for American Express.
• Expiry: any month and year in the future, such as 12/34.
• Address and ZIP: any value, unless the card number itself is built to return a postal code failure.

Some decline cards return their code no matter what you type in the CVC field. Change the card number, not the CVC, when you want a different error.

How do test tokens and payment methods fit in?

Stripe also exposes test tokens such as tok_visa and test payment method IDs such as pm_card_visa. They stand in for raw card numbers in server-side calls, which keeps your suite short and stops you from pasting numbers into fixtures.

• tok_visa, tok_mastercard, tok_amex: create a chargeable token without a card form.
• pm_card_visa: attach a card to a PaymentIntent in one step.
• Tokens carry the same limits as numbers. They fail against a live key.

For client-side testing, Stripe's own browser test helpers fill the card field for you.

Can you use Stripe test cards in live mode?

No. Live keys reject every published test number. Test numbers sit in public documentation, so a processor that accepted them would be handing out free goods.

If a charge against a live key returns a decline for 4242 4242 4242 4242, that result is correct. The problem is the key, not the number.

What trips people up in Stripe test mode?

• Test data and live data stay apart. A customer created with a test key does not exist under a live key, and you cannot copy records between the two.
• Radar and risk rules act with different strictness in test mode, so a charge that passes there can still get blocked in production.
• Test clocks push subscriptions forward in time, which helps with renewal and dunning tests.
• Webhooks fire in test mode and use the same event names, so point a local listener at the test endpoint.

One more detail: these numbers are public. Anyone can type them. They identify no person and prove nothing about a card.

Is buying or selling real card data legal?

No. Selling a real card number, CVC, or full track data is illegal in the US and in most other countries, and the FTC treats it as fraud. Sites that trade card data operate outside the law and outside the card networks.

PCI DSS bans keeping the CVC or CVV2 in any form after a transaction authorizes. That rule covers merchants, processors, and anyone else in the payment chain.

For developers, the clean path is Stripe test mode plus the test cards listed above. You get the same request and response shapes with no legal exposure.

Frequently asked questions

Does 4242 4242 4242 4242 work for subscriptions?

Yes. In test mode it creates a customer, saves the card, and starts a subscription. Pair it with a test clock to move through billing cycles.

Why does my test card get declined with a live key?

Because Stripe blocks every published test number outside test mode. Switch to your test keys and try again.

Where does Stripe list every test card?

Stripe's API documentation holds the master list, grouped by decline reason and by region. Treat that page as the source of truth when a number copied from a blog post stops working.