EMV Test Cards
Make your own EMV test cards: card data and keys, a Java Card applet, and one small kit that builds the CAP and installs it on a JCOP card.
Test cards only: made-up card numbers and test keys. Never put live card data or live keys on a test card.
From a blank form to a card a terminal can read
Make your own EMV test cards for a terminal or host project. Start from one of 12 templates, change what you need, and the site generates the keys and certificates, the Java Card applet, and a small kit that builds the CAP file and installs it on a JCOP card from your Windows PC.
What you need
- A Java Card the kit supports: J3R180 (NXP JCOP 4 (P71), newer mask), J3R150 (NXP JCOP 4 (P71)), J2A040 (NXP JCOP 2.4.1).
- A contact PC/SC reader. Applets are loaded over the contact interface only.
- A Windows PC (Windows 10 or 11): the kit uses PowerShell, which Windows already has.
- The Java tools, installed once, from their official sites:
| Tool | For | Tested version | Download |
|---|---|---|---|
| Eclipse Temurin JDK 8 Compiles the applets and runs the Java Card converter. |
Build | 8u504-b01 | Official download |
| Eclipse Temurin JRE 21 (or any Java 11+) Runs gp.jar, which needs Java 11 or later. |
Install | 21.0.12.1 | Official download |
| GlobalPlatformPro gp.jar Talks to the card's security domain: load, install, list, delete. |
Install | v25.10.20 (v24.10.15 also works) | Official download |
| Oracle Java Card Classic Development Kit 3.0.5u4 The Java Card 3.0.5 API and converter, for JCOP 4 cards. |
Build | 3.0.5u4 | Official download |
| Oracle Java Card Development Kit 2.2.2 The Java Card 2.2.2 API and converter, for the J2A040. |
Build | 2.2.2 | Official download |
The kit does not include these tools: they come from their publishers, under their own licences. Its Check my setup finds them once installed. A PC that only installs cards someone else built needs Java 11+ and gp.jar. Versions checked on 2026-10-25.
Safe by default
- Test cards only. Templates use made-up card numbers, the site's training keys and our own test CA: no brand test keys or brand test card data.
- Your cards stay in your browser. Only a card being generated goes to the server, which keeps nothing.
- Card keys stay on your PC. The website never asks for the keys of your card's security domain; you set them in the kit's
card.env. - The kit stops at the first failed secure channel. Each failure counts down the card's lock counter; at zero the card is locked for good.
- Nothing destructive by accident. Remove deletes only the applets the kit installed; Wipe shows its plan and needs you to type
wipe, and never deletes the security domain.
Before loading a card, you can study the same EMV flow in the EMV simulator; afterwards, review a terminal trace in the Trace Analyzer.