Test Credit Card Expiry Date: Format and Rules

What a Test Credit Card Expiry Date Is

A test credit card expiry date is a future date written as MM/YY. It pairs with a sandbox card number published by a payment processor. The pair passes validation in test mode and gets rejected in live mode. No bank account sits behind it.

Test card data exists so developers can run checkout, subscription, and refund flows without moving money.

Format Rules

• Month: two digits, 01 through 12.
• Year: two digits. Some forms take four.
• Cards print the date as MM/YY with a slash.
• API fields split the value. Stripe takes exp_month and exp_year as integers.
• The value stays valid through the last day of the month. A card marked 04/27 works on April 30, 2027 and fails on May 1, 2027.

How Gateways Validate the Date

1. The form checks the string against a pattern.
2. The gateway compares month and year to the server clock.
3. A past date returns an expired card decline. In ISO 8583 mapping that is response code 54.
4. A future date passes. The CVV check runs on a separate path.

Some processors accept any future date in test mode. Others require the exact value printed in their documentation. Stripe test cards use a fixed future year that the docs update as time passes.

Where the Values Come From

Each processor publishes its own table. Stripe, PayPal, Adyen, and Authorize.Net all list test numbers with matching expiry dates and CVV values. The PAN follows ISO/IEC 7812. The expiry field follows ISO/IEC 7813.

Use the value from the same table as the card number. Mixing a Stripe test PAN with an Adyen test expiry can trip a sandbox rule.

Test Clocks

Stripe test clocks move the sandbox clock forward. That lets a developer watch a card reach its expiry month, watch a subscription renew, and watch a dunning flow fire. The test clock does not touch the real clock on the server that runs your code.

Errors That Show Up in Practice

• Two-digit year pivot. Many libraries map 00 through 68 to 2000 through 2068.
• Timezone drift. A server in UTC can call a card expired a day before a browser in UTC-8 does.
• Hardcoded test years. A year that works in January stops working the next January.
• Live keys. A test expiry date on a live endpoint returns an invalid card error, not a test result.

What Test Data Is Not

A test expiry date is not a real account, a real credit line, or a way to authorize a charge. Processors block test PAN ranges from production networks. Storing a real expiry date with a real PAN falls under PCI DSS Requirement 3, which covers data retention and protection. The rules for test data in a sandbox differ from the rules for cardholder data in production.