Expiry Date Test: Card Expiry Validation Guide

An expiry date test checks that a payment form accepts valid card expiration dates and rejects invalid ones. A valid date is four digits in MM/YY form. The month runs 01 to 12. The year is two digits.

What the test covers

Three checks apply to every expiry field. Format: two digits, a separator, two more digits. Range: the month sits between 01 and 12. Recency: the date has not passed.

A card keeps its full month. A card marked 09/25 stays valid through September 30, 2025. It expires on October 1, 2025.

Format rules

• Accept MM/YY and MM/YYYY.
• Reject letters, spaces, hyphens, and symbols.
• Reject a missing slash when the input mask does not insert one.
• Reject a bare month such as 1/25. Most processors require the leading zero.
• Reject 5 digits and 6 digits unless the field is a year-only variant.

Edge cases for a test suite

1. Month 00 and month 13.
2. Past year with a future month, such as 12/20.
3. Current month in the current year. This date is valid until the last day of that month.
4. Far future date, such as 12/99. Some gateways cap the accepted range at 10 to 19 years.
5. Two-digit year rollover: 01/00 and 12/49.
6. Empty field, single digit, trailing whitespace.
7. Paste events that carry a slash, a dash, or a tab character.

Sandbox test cards

Stripe, Adyen, and Braintree publish test card numbers with fixed expiry dates for sandbox use. Each number returns a known response code, so a tester can confirm the field maps to the right outcome. These numbers work in test mode. They fail in live mode.

Failures the test should catch

A form that rejects a valid date loses a sale. A form that accepts an expired date sends a request that the issuer declines and adds a failed authorization to the log. A form that stores the raw string in an odd format breaks reconciliation and dunning.

Check the error message text too. A clear message tells the buyer which digits failed.

Storage and scope

PCI DSS treats the expiration date as cardholder data when it is stored with the primary account number. A system that keeps expiry dates falls in scope for the encryption and access control rules. The CVV is a separate case: PCI DSS forbids storage of the CVV after authorization.

Quick checklist

• Valid month, valid future year: pass.
• Valid month, past year: fail with a clear message.
• Month 00 or 13: fail.
• Non-numeric input: fail.
• Current month, current year: pass.