Browse the Knowledge Hub56 resources
Test cases
Performance test cases, for what happens after the spike
Twenty eight cases covering percentile reporting rather than averages, sudden spikes with no ramp, recovery to baseline, deliberate breaking points, graceful shedding, soak testing for leaks, pool exhaustion, slow dependencies, retry storms, cold caches, cache stampedes, production scale data and data correctness under load.
All 28 test cases, ready to copy
Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.
Last updated
28 worked examples
Meet the response time budget at expected load
TypePerformancePriorityHigh- Test data
- Sustained expected concurrent users against the critical journey
- Expected result
- Median and 95th percentile response times sit inside the agreed budget, and the budget is a stated number rather than an impression of feeling fast.
Report percentiles rather than averages
TypePerformancePriorityHigh- Test data
- The same run measured at median, 95th and 99th percentile
- Expected result
- Results are reported as percentiles. An average hides the slow tail entirely, and the tail is what users complain about.
Sustain peak load for a realistic duration
TypePerformancePriorityHigh- Test data
- Peak expected concurrency held for the length of a real peak period
- Expected result
- Response times and error rate stay inside budget for the whole period rather than only for the first few minutes.
Survive a sudden spike without a ramp
TypePerformancePriorityHigh- Test data
- Jump from idle to peak concurrency within seconds
- Expected result
- System degrades gracefully rather than failing. Autoscaling and connection pools that cope with a gentle ramp frequently collapse on an instant spike.
Recover after the load is removed
TypeStatePriorityHigh- Test data
- Drive load beyond capacity, then return to normal traffic
- Expected result
- Response times return to baseline within a stated period. A system that stays degraded after the spike has passed has a queue or pool it never drains.
Find the breaking point deliberately
TypePerformancePriorityHigh- Test data
- Increase load stepwise until the error rate or latency breaches the threshold
- Expected result
- The breaking point is a known number with a known first symptom, so capacity planning is based on measurement rather than estimate.
Degrade gracefully beyond capacity
TypeStatePriorityHigh- Test data
- Hold load past the breaking point
- Expected result
- Requests are shed with a clear retryable response rather than every request timing out slowly, and no request is accepted that cannot be served.
Run a soak test for memory and resource leaks
TypePerformancePriorityHigh- Test data
- Moderate load sustained for several hours or overnight
- Expected result
- Memory, connections, file handles and thread counts return to a stable plateau rather than climbing steadily until a restart is required.
Exhaust and recover the connection pool
TypeBoundaryPriorityHigh- Test data
- Concurrency above the configured pool size, with one deliberately slow query
- Expected result
- Waiting requests fail with a clear timeout rather than hanging indefinitely, and the pool recovers fully once the slow query completes.
Behave correctly when a dependency is slow
TypeStatePriorityHigh- Test data
- Add two seconds of latency to a downstream service under load
- Expected result
- Calls time out at a bounded value, threads are not exhausted waiting, and the slow dependency does not turn one degraded feature into a total outage.
Open the circuit breaker and close it again
TypeStatePriorityHigh- Test data
- Fail a dependency repeatedly under load, then restore it
- Expected result
- Breaker opens on the documented threshold, the fallback is served, and it closes once health returns rather than requiring a deployment.
Avoid a retry storm
TypeBoundaryPriorityHigh- Test data
- A dependency failure with client and server retries both active
- Expected result
- Retries use backoff with jitter and a bounded count, so recovery is not prevented by every client retrying in the same instant.
Perform under a cold cache
TypePerformancePriorityHigh- Test data
- Peak load immediately after a cache flush or a deployment
- Expected result
- Response times stay inside a stated cold budget. A system that only meets its target warm has no headroom at exactly the moment it restarts.
Prevent a cache stampede on expiry
TypeBoundaryPriorityHigh- Test data
- A widely used cache entry expiring while under heavy load
- Expected result
- One request repopulates the entry while others wait or serve stale, rather than every concurrent request recomputing it simultaneously.
Perform against production scale data
TypePerformancePriorityHigh- Test data
- The same queries against a full size data set rather than a seeded sample
- Expected result
- Results hold at real volume. A query that is fast against ten thousand rows and unusable against ten million is invisible on a small test database.
Detect queries that scale with result count
TypePerformancePriorityHigh- Test data
- A list endpoint returning 10, 100 and 1,000 records with query counts logged
- Expected result
- Query count stays flat rather than growing with the number of records, which is the signature of a query issued per row.
Keep the slowest endpoints inside their own budgets
TypePerformancePriorityHigh- Test data
- Search, report generation, export and dashboard aggregation under load
- Expected result
- Each has its own budget appropriate to its work, and a long running operation runs asynchronously rather than holding a request open.
Handle a large payload and a large export
TypeBoundaryPriorityMedium- Test data
- A request at the maximum permitted body size, and an export of the largest realistic result set
- Expected result
- Both complete or are refused deliberately with a documented limit, and neither exhausts memory by materialising the whole result at once.
Sustain a realistic write load
TypePerformancePriorityHigh- Test data
- Concurrent writes to the same contended records at peak rate
- Expected result
- Throughput holds without deadlocks or lock timeouts, and any conflict is reported as a retryable conflict rather than a server error.
Keep data correct under concurrent load
TypeStatePriorityHigh- Test data
- A load test that includes balance updates, counters and inventory decrements
- Expected result
- Final values reconcile exactly with the operations performed. A load test that only measures latency will pass while silently corrupting totals.
Process a background queue without unbounded backlog
TypeStatePriorityHigh- Test data
- Enqueue faster than the consumer rate for a sustained period
- Expected result
- Backlog is visible and bounded, oldest items are not starved, and the queue drains at a measured rate once input returns to normal.
Handle a scheduled job overlapping the previous run
TypeBoundaryPriorityHigh- Test data
- A job that takes longer than its interval under load
- Expected result
- Second run is skipped or queued rather than running concurrently, and no work is processed twice as a result of the overlap.
Enforce rate limits without harming legitimate traffic
TypeSecurityPriorityHigh- Test data
- One abusive client at high rate alongside normal traffic
- Expected result
- Abusive client is throttled with a clear response and legitimate users are unaffected, with limits applied per credential rather than by address alone.
Meet front end loading budgets on a real network
TypePerformancePriorityHigh- Test data
- Key pages on a throttled mobile connection on a mid range device
- Expected result
- Loading, interactivity and layout stability metrics meet their budgets on that profile rather than only on a fast desktop connection.
Stay responsive while rendering a large collection
TypePerformancePriorityMedium- Test data
- A list or table of 10,000 rows with scrolling, sorting and filtering
- Expected result
- Interface remains responsive through virtualisation or pagination, and input is never blocked for a perceptible period.
Perform correctly behind a proxy or load balancer
TypeCompatibilityPriorityMedium- Test data
- Load through the full production path including proxy, balancer and content delivery layer
- Expected result
- Timeouts at each layer are ordered sensibly, sessions distribute correctly, and no layer terminates a request the application still considers active.
Produce usable diagnostics under load
TypeStatePriorityHigh- Test data
- A load run with monitoring, tracing and logging enabled
- Expected result
- Slow requests are traceable to a component, logging itself does not become the bottleneck, and metrics are retained long enough to compare against the next run.
Compare against a recorded baseline
TypePerformancePriorityHigh- Test data
- The same scenario, data volume and environment as the previous release
- Expected result
- Results are compared against a stored baseline so a regression is a measured difference rather than an opinion, with the environment stated alongside.
What goes in each field
ID
RequiredStable identifier, prefixed by module.
Test case
RequiredWhat is being verified, in one line.
Type
Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.
Priority
Risk based, weighted by user impact at peak. Anything that causes errors, data loss or an unrecoverable state under load is High. Pure latency regressions are ranked by how far they exceed the agreed budget.
Test data
The specific values, including the invalid and boundary ones.
Expected result
RequiredThe precise observable outcome, including message text where the wording itself is the requirement.
Remove the load and keep measuring
A smooth ramp to a target number is the least informative test in this set. These four conditions are where systems actually fall over.
Skip the ramp entirely
Go from idle to peak in seconds. Autoscaling policies and connection pools that handle a gentle ramp routinely collapse under an instant spike, which is what a marketing email produces.
Measure the recovery, not just the peak
Push past capacity, then return to normal traffic and keep watching. A system that stays degraded afterwards has a queue or pool it never drains.
Load test at production data volume
A query that is fast against ten thousand rows and unusable against ten million looks perfect on a seeded test database. Volume is part of the test conditions.
Check the numbers, not only the timings
Include balance updates, counters and inventory decrements, then reconcile. A load test that measures only latency will pass while silently corrupting totals.
Why load tests pass and systems fail
The standard load test is a gradual ramp to a target concurrency, held briefly, reported as an average. Almost every part of that is the wrong shape. Real traffic arrives as a spike rather than a ramp, which is what breaks autoscaling and connection pools. Real peaks last for an hour rather than five minutes, which is what surfaces leaks and queue growth. And an average conceals the slow tail completely, so the report says the system is fast while the 99th percentile is timing out. Percentiles are not a refinement here, they are the measurement.
Recovery is the most commonly skipped case and one of the most informative. Anyone can observe that a system slows down past capacity. The question that matters operationally is whether it returns to baseline when the load goes away, because a system that stays degraded has a bounded resource it is not releasing, and in production that turns a ten minute traffic peak into an outage lasting until somebody restarts something. Related to it are the failure shapes: shedding load with a clear retryable response is a good outcome, while accepting every request and timing all of them out slowly is the worst one.
Dependencies fail more often than capacity does. A downstream service that becomes slow rather than unavailable is the most dangerous case, because unbounded waiting exhausts the thread or connection pool and converts one degraded feature into a total outage. Circuit breakers need testing in both directions, including closing again without a deployment. And retries need backoff with jitter, because synchronised retries from every client prevent the recovery they are trying to achieve.
Finally, caches and data volume are where test environments lie. A system measured only with a warm cache has no headroom at the exact moment it restarts, and a widely shared cache entry expiring under load will be recomputed by every concurrent request at once unless something coalesces them. Both are invisible unless deliberately provoked. The same applies to query behaviour: logging query counts while returning ten, a hundred and a thousand records exposes a query issued per row immediately, and that single pattern is behind a large share of endpoints that are fine in testing and unusable in production.
Suggest an improvementNeed load testing against production scale?
QAble runs performance engagements with realistic traffic shapes and production volume data, reporting percentiles, breaking points and the first symptom at each threshold.
Load and performance testing servicesMore test case sets
View allTest cases for a login page
Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.Test cases for a registration form
Test cases28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.Test cases for search functionality
Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.Test cases for a shopping cart
Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.Test cases for checkout and payment
Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.Test cases for file upload
Test cases28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.Test cases for forgot password
Test cases26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.Test cases for OTP verification
Test cases26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.Test cases for user roles and permissions
Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.Test cases for form validation
Test cases27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.Test cases for a date picker
Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.Test cases for pagination
Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.Test cases for push notifications
Test cases26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.Test cases for reports and data export
Test cases25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.Test cases for a chatbot
Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.Test cases for net banking transactions
Test cases28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.Test cases for wallet and UPI payments
Test cases28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.Test cases for insurance claim submission
Test cases28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.Test cases for patient records in an EHR
Test cases28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.Test cases for CRM lead management
Test cases28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.Test cases for an ERP purchase order
Test cases28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.Test cases for OTT video playback
Test cases28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.Test cases for game level progression
Test cases28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.Test cases for a REST API
Test cases28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.Test cases for SSO and social login
Test cases28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.Test cases for subscription and billing
Test cases28 cases on mid cycle proration, duplicate and out of order webhooks, renewal double charges, dunning and grace, trials, coupons, metered usage and tax.Test cases for data tables, filters and sorting
Test cases28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.Test cases for session timeout and concurrent login
Test cases28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.Test cases for a multi step form wizard
Test cases28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.Test cases for email verification
Test cases28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.Test cases for dashboards and analytics widgets
Test cases28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.Test cases for booking and reservation
Test cases28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.Test cases for mobile app install and update
Test cases28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.Test cases for accessibility (WCAG 2.2 AA)
Test cases28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.Test cases for the OWASP Top 10
Test cases28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.Test cases for cross browser compatibility
Test cases28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.Test cases for database and data integrity
Test cases28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.Test cases for localisation and multi language support
Test cases28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.Want your capacity measured, not assumed?
QAble covers load, spike, soak and stress profiles with ISTQB-certified engineers. Start with a free performance audit of your platform.