Payment test data
Random PayPal cards
Generate Luhn-valid Visa, Mastercard, American Express, Diners Club, Maestro, CUP, and JCB numbers with future expiry and CVV values.
PayPal error triggers
Quickly exercise refused, fraud, expired, invalid, insufficient-funds, stolen-card, generic-decline, and CVV-failure paths.
Stripe scenario library
Select predefined success, decline, and 3D Secure test cards without searching external documentation during every test.
Context-menu cards
Insert common PayPal or Stripe values directly into the last focused input field.
Form automation
Full-form auto-fill
Detect and fill card number, expiry, CVV, cardholder name, and country fields using common names, IDs, placeholders, and autocomplete attributes.
Framework-compatible events
Dispatch native input and change events so controlled fields in React and similar applications can observe the new values.
Combined or split expiry
Support a single expiry input as well as separate month and year inputs or select controls.
Supported development hosts
Run on PayPal, Stripe, local development hosts, and App Engine applications declared in the content-script configuration.
Sidebar and customization
- Persistent side-panel workflow in Chrome.
- Firefox sidebar integration through
sidebar_action. - Default billing country selected from a built-in country list.
- Configurable cardholder name.
- Separate card background preferences for PayPal and Stripe.
- English and Vietnamese interfaces.
Local storage and privacy
Sandbox Pay stores user preferences through WXT’s browser storage API. The current manifest requests no required Firefox data collection and does not require payment-account credentials.Test card data is generated locally or selected from static sandbox values included in the extension source. Sandbox Pay is designed to reduce repetitive testing input, not to process payments.
Browser support
Known limitations
- Provider rules and official test-card lists can change.
- Automatic filling depends on the current page markup.
- Cross-origin secure payment iframes may block content-script access.
- The declared content script does not run on arbitrary production domains.
- Generated Luhn-valid values are not guaranteed to be accepted by a specific provider or account configuration.