CVV Test Page Source Guide: How to Find and Use It
Learn how to locate and utilize a CVV test page source to verify credit card data.
CVV Test Page Sample: Sandbox Guide for Developers
What is a CVV test page sample?
A CVV test page sample is a mock checkout form that runs inside a payment sandbox so developers can confirm the security-code field works. It pairs fake card numbers issued by a processor with dummy codes. Real cardholder data never enters the page.
Teams use it to check validation rules, error messages, and tokenization before a live launch. Stripe, PayPal, Adyen, and Authorize.net each publish test card sets for this job.
What does a CVV test page contain?
- A card number field that accepts sandbox test numbers
- An expiry field (any future date passes in test mode)
- A CVV or CVC field: 3 digits for most brands, 4 for American Express
- A billing ZIP or postal code field for address verification tests
- A submit button wired to the sandbox endpoint
- Error states for declined cards and failed CVV checks
Which test card numbers and CVVs work in a sandbox?
Every processor publishes its own list, and the digits differ by vendor. Stripe's standard test card, 4242 4242 4242 4242, accepts any 3-digit CVV and any future expiry date. That card always approves, so it proves the form works, not that your decline handling works.
You also need cards that fail. Most processors ship a generic decline card, a card that fails the CVV check, and a card that fails the postal code check. Pull the exact numbers from your processor's test documentation, because vendors change sandbox values when they update their platforms.
How do you build a CVV test page?
- Create a sandbox account and copy the test API keys.
- Build the form with card number, expiry, CVV, and billing ZIP fields.
- Point the form at the sandbox endpoint, never the live one.
- Add client-side validation: digits only, correct length per brand, no spaces.
- Run four cases: approval, generic decline, CVV mismatch, and expired card.
- Log response codes and strip the CVV out of every log file.
A live key turns a sandbox exercise into a real authorization request. Keep the two key sets in separate environments and label them so nobody on the team mixes them up.
Which validation rules should the CVV field enforce?
- Length: 3 digits for Visa, Mastercard, and Discover; 4 for American Express
- Characters: digits only, no letters or symbols
- Format: strip spaces and dashes before sending the request
- Required: block submission when the field is empty
- Response handling: show a clear message when the issuer reports a CVV failure
Build the field so it changes length rules once the form detects an Amex number. That single check prevents a common support ticket.
How do sandbox CVV checks differ from live checks?
In a sandbox the processor returns a canned response, so the value you type changes the outcome only when you use a card built to fail the CVC check. In production the issuer compares the code against its records and returns match, no-match, or not-checked.
That gap matters. A form that passes every sandbox test can still fail in production when an issuer declines on a mismatch, so test your error copy and your retry flow with the mismatch card.
Checklist before you ship the test page
- Sandbox keys confirmed, live keys absent from the codebase
- Four response paths tested and screenshotted
- CVV field excluded from analytics, logs, and database writes
- Mobile keyboard set to numeric for the CVV input
- Error messages written in plain language
What should a CVV test page never do?
PCI DSS forbids storing the CVV after an authorization, even when the data comes from a test run. Keep test data and live data in separate systems with separate access rules.
Buying or selling real card data is a crime in the United States and most other countries. A CVV test page has one lawful purpose: verifying your own payment integration with numbers the processor published for testing.
Frequently asked questions
Does a CVV test page work with live API keys?
No. Live keys push real authorization requests to the card networks, and test card numbers will fail or trip fraud checks. Always use sandbox keys on a test page.
What CVV should I type on a Stripe test page?
Any 3 digits. Stripe's sandbox ignores the value unless you use a card that is meant to fail the CVC check.
Can I test a 4-digit American Express CVV?
Yes. Amex cards carry a 4-digit code on the front of the card. Include at least one Amex test card so your form accepts the longer value.
Is testing a CVV field legal?
Yes, when the numbers come from a processor's published test set. Entering real card numbers you do not own is fraud.
How do I know my CVV field works?
Run an approval case and a CVV mismatch case. If the form accepts the good code and rejects the bad one with the right message, the field works.