A card expiration test checks whether a payment card's expiry date is present, formatted correctly, and not in the past. It is a payment form validation and QA step, not a way to confirm that a card is active, funded, or authorized. Use test card numbers from your payment processor when you need to exercise expiry validation in development.
What a Card Expiration Test Checks
A card expiration test typically covers four points: presence, format, month range, and date order. The form should require an expiration value, accept a two-digit month and a two-digit or four-digit year, reject month values outside 01 to 12, and reject a date that has already passed. Many payment forms use the MM/YY format because it matches the physical card and the autocomplete token cc-exp.
- Presence: the field is not empty.
- Format: the value matches MM/YY or MM/YYYY.
- Range: the month is 01 through 12.
- Date order: the expiration month and year are not before the current month and year.
Legitimate Uses for Card Expiration Testing
Merchants, developers, and QA teams use card expiration tests to catch checkout errors before customers see them. A test can confirm that a form rejects an expired date, accepts a future date, handles leading zeros, and shows a clear error message. Payment processors provide test card numbers for sandbox environments, so teams do not need real card data to run these checks.
Card expiration testing also supports accessibility and usability reviews. A clear label, a short input mask, and an error message such as Enter a valid expiration date help customers correct mistakes without guessing. The test should cover keyboard entry, paste behavior, and mobile numeric keyboards.
How to Implement a Card Expiration Test
- Validate on the client for fast feedback, then repeat the check on the server.
- Normalize the input by removing spaces and slashes before parsing.
- Store test values only in test environments and use processor-provided test cards.
- Compare the entered month and year with the current month and year, not with a fixed date.
- Return a specific error for format problems and a separate error for expired dates.
Server-side validation matters because client-side checks can be bypassed. The server should reject invalid or expired dates before it sends an authorization request. Log validation failures without storing full card numbers, CVV values, or other sensitive authentication data.
What a Card Expiration Test Cannot Tell You
A card expiration test cannot prove that a card number is valid, that the card is open, or that funds are available. Those checks happen during authorization with the issuer. A test that only checks the expiration field is a form validation test, not a card verification test. Do not use random card numbers against live payment systems, and do not treat a passing expiration check as proof of ownership.
Security and Compliance Notes
Payment card data requires careful handling. PCI DSS limits storage of sensitive authentication data, including CVV and full track data, and merchants should follow their processor's guidance for tokenization and test environments. OWASP recommends input validation on both the client and the server. W3C autocomplete attributes, such as cc-exp, can improve form usability while keeping the validation logic in your application.