PayPal does not hand out a single universal test card number the way Stripe does. Your test card is generated inside your own sandbox account, and you read it from the PayPal developer dashboard. For the CVV field, any three digits work. For expiry, pick any date in the future. The number itself only works against the sandbox, never the live site.
Where the real sandbox card lives
Log in to developer.paypal.com with your business account, open Sandbox, then Accounts. Pick one of the Personal accounts in the list, click View/Edit, and look for the Credit Card tab. That panel shows the card number PayPal issued to that fake buyer, plus the expiry it expects. Copy it exactly. The menu labels shift between dashboard versions, so if you don't see Credit Card right away, look under the account's funding or profile section.
I keep that tab open in a second window while I test. The card is bound to that specific sandbox account, so a number from one sandbox won't behave the same in another.
paypal sandbox test card verification
What to type in each field
- CVV: any three digits, like 123. PayPal's sandbox does not validate it against the card.
- Expiry: any month and year ahead of today.
- Billing address: the address stored on the sandbox Personal account, or any address if AVS checks are off.
- Name: whatever the sandbox profile says. Mismatches rarely block a test charge.
The classic numbers people try first
Sooner or later you'll see 4111111111111111 floating around, and 5555555555554444 for Mastercard. Those are generic gateway test numbers, not PayPal ones. They work in plenty of payment integrations, and a lot of developers report them passing in PayPal sandbox credit card fields too. But results vary by checkout type and by how the sandbox account is configured. If one gets declined, don't assume your integration is broken. Go back to the dashboard and pull the card assigned to your sandbox buyer instead. That's the number PayPal actually expects.
PayPal Sandbox Test Credit Card Details: Safe Testing Guide
Testing declines on purpose
Open the sandbox account settings and turn on negative testing. That switch lets you trigger specific failure responses by sending matching amounts or error codes through the API, so you can watch your checkout handle a declined card without guessing. It's the fastest way to confirm your error messaging reaches the buyer.
Things that trip people up
Sandbox cards expire. If a test card you saved months ago suddenly fails, check the date before you debug anything else. Also confirm you're pointed at the sandbox API host and not live, and that the sandbox seller account you're paying is the one you think it is. A mismatch there produces vague errors that look like card problems but aren't.
One more: 3D Secure flows in sandbox have their own test credentials. If your checkout triggers a challenge, the card number alone won't get you through.