View all services
Talk to QA Advisor
Browse the Knowledge Hub56 resources
/Test Cases/Performance and load test cases

Test cases

Performance test cases, for what happens after the spike

Twenty eight cases covering percentile reporting rather than averages, sudden spikes with no ramp, recovery to baseline, deliberate breaking points, graceful shedding, soak testing for leaks, pool exhaustion, slow dependencies, retry storms, cold caches, cache stampedes, production scale data and data correctness under load.

28cases/8coverage types/21high priority/FreeCSV download

All 28 test cases, ready to copy

Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.

Last updated

28 worked examples

PERF-01

Meet the response time budget at expected load

TypePerformancePriorityHigh
Test data
Sustained expected concurrent users against the critical journey
Expected result
Median and 95th percentile response times sit inside the agreed budget, and the budget is a stated number rather than an impression of feeling fast.
PERF-02

Report percentiles rather than averages

TypePerformancePriorityHigh
Test data
The same run measured at median, 95th and 99th percentile
Expected result
Results are reported as percentiles. An average hides the slow tail entirely, and the tail is what users complain about.
PERF-03

Sustain peak load for a realistic duration

TypePerformancePriorityHigh
Test data
Peak expected concurrency held for the length of a real peak period
Expected result
Response times and error rate stay inside budget for the whole period rather than only for the first few minutes.
PERF-04

Survive a sudden spike without a ramp

TypePerformancePriorityHigh
Test data
Jump from idle to peak concurrency within seconds
Expected result
System degrades gracefully rather than failing. Autoscaling and connection pools that cope with a gentle ramp frequently collapse on an instant spike.
PERF-05

Recover after the load is removed

TypeStatePriorityHigh
Test data
Drive load beyond capacity, then return to normal traffic
Expected result
Response times return to baseline within a stated period. A system that stays degraded after the spike has passed has a queue or pool it never drains.
PERF-06

Find the breaking point deliberately

TypePerformancePriorityHigh
Test data
Increase load stepwise until the error rate or latency breaches the threshold
Expected result
The breaking point is a known number with a known first symptom, so capacity planning is based on measurement rather than estimate.
PERF-07

Degrade gracefully beyond capacity

TypeStatePriorityHigh
Test data
Hold load past the breaking point
Expected result
Requests are shed with a clear retryable response rather than every request timing out slowly, and no request is accepted that cannot be served.
PERF-08

Run a soak test for memory and resource leaks

TypePerformancePriorityHigh
Test data
Moderate load sustained for several hours or overnight
Expected result
Memory, connections, file handles and thread counts return to a stable plateau rather than climbing steadily until a restart is required.
PERF-09

Exhaust and recover the connection pool

TypeBoundaryPriorityHigh
Test data
Concurrency above the configured pool size, with one deliberately slow query
Expected result
Waiting requests fail with a clear timeout rather than hanging indefinitely, and the pool recovers fully once the slow query completes.
PERF-10

Behave correctly when a dependency is slow

TypeStatePriorityHigh
Test data
Add two seconds of latency to a downstream service under load
Expected result
Calls time out at a bounded value, threads are not exhausted waiting, and the slow dependency does not turn one degraded feature into a total outage.
PERF-11

Open the circuit breaker and close it again

TypeStatePriorityHigh
Test data
Fail a dependency repeatedly under load, then restore it
Expected result
Breaker opens on the documented threshold, the fallback is served, and it closes once health returns rather than requiring a deployment.
PERF-12

Avoid a retry storm

TypeBoundaryPriorityHigh
Test data
A dependency failure with client and server retries both active
Expected result
Retries use backoff with jitter and a bounded count, so recovery is not prevented by every client retrying in the same instant.
PERF-13

Perform under a cold cache

TypePerformancePriorityHigh
Test data
Peak load immediately after a cache flush or a deployment
Expected result
Response times stay inside a stated cold budget. A system that only meets its target warm has no headroom at exactly the moment it restarts.
PERF-14

Prevent a cache stampede on expiry

TypeBoundaryPriorityHigh
Test data
A widely used cache entry expiring while under heavy load
Expected result
One request repopulates the entry while others wait or serve stale, rather than every concurrent request recomputing it simultaneously.
PERF-15

Perform against production scale data

TypePerformancePriorityHigh
Test data
The same queries against a full size data set rather than a seeded sample
Expected result
Results hold at real volume. A query that is fast against ten thousand rows and unusable against ten million is invisible on a small test database.
PERF-16

Detect queries that scale with result count

TypePerformancePriorityHigh
Test data
A list endpoint returning 10, 100 and 1,000 records with query counts logged
Expected result
Query count stays flat rather than growing with the number of records, which is the signature of a query issued per row.
PERF-17

Keep the slowest endpoints inside their own budgets

TypePerformancePriorityHigh
Test data
Search, report generation, export and dashboard aggregation under load
Expected result
Each has its own budget appropriate to its work, and a long running operation runs asynchronously rather than holding a request open.
PERF-18

Handle a large payload and a large export

TypeBoundaryPriorityMedium
Test data
A request at the maximum permitted body size, and an export of the largest realistic result set
Expected result
Both complete or are refused deliberately with a documented limit, and neither exhausts memory by materialising the whole result at once.
PERF-19

Sustain a realistic write load

TypePerformancePriorityHigh
Test data
Concurrent writes to the same contended records at peak rate
Expected result
Throughput holds without deadlocks or lock timeouts, and any conflict is reported as a retryable conflict rather than a server error.
PERF-20

Keep data correct under concurrent load

TypeStatePriorityHigh
Test data
A load test that includes balance updates, counters and inventory decrements
Expected result
Final values reconcile exactly with the operations performed. A load test that only measures latency will pass while silently corrupting totals.
PERF-21

Process a background queue without unbounded backlog

TypeStatePriorityHigh
Test data
Enqueue faster than the consumer rate for a sustained period
Expected result
Backlog is visible and bounded, oldest items are not starved, and the queue drains at a measured rate once input returns to normal.
PERF-22

Handle a scheduled job overlapping the previous run

TypeBoundaryPriorityHigh
Test data
A job that takes longer than its interval under load
Expected result
Second run is skipped or queued rather than running concurrently, and no work is processed twice as a result of the overlap.
PERF-23

Enforce rate limits without harming legitimate traffic

TypeSecurityPriorityHigh
Test data
One abusive client at high rate alongside normal traffic
Expected result
Abusive client is throttled with a clear response and legitimate users are unaffected, with limits applied per credential rather than by address alone.
PERF-24

Meet front end loading budgets on a real network

TypePerformancePriorityHigh
Test data
Key pages on a throttled mobile connection on a mid range device
Expected result
Loading, interactivity and layout stability metrics meet their budgets on that profile rather than only on a fast desktop connection.
PERF-25

Stay responsive while rendering a large collection

TypePerformancePriorityMedium
Test data
A list or table of 10,000 rows with scrolling, sorting and filtering
Expected result
Interface remains responsive through virtualisation or pagination, and input is never blocked for a perceptible period.
PERF-26

Perform correctly behind a proxy or load balancer

TypeCompatibilityPriorityMedium
Test data
Load through the full production path including proxy, balancer and content delivery layer
Expected result
Timeouts at each layer are ordered sensibly, sessions distribute correctly, and no layer terminates a request the application still considers active.
PERF-27

Produce usable diagnostics under load

TypeStatePriorityHigh
Test data
A load run with monitoring, tracing and logging enabled
Expected result
Slow requests are traceable to a component, logging itself does not become the bottleneck, and metrics are retained long enough to compare against the next run.
PERF-28

Compare against a recorded baseline

TypePerformancePriorityHigh
Test data
The same scenario, data volume and environment as the previous release
Expected result
Results are compared against a stored baseline so a regression is a measured difference rather than an opinion, with the environment stated alongside.

What goes in each field

ID

Required

Stable identifier, prefixed by module.

Test case

Required

What is being verified, in one line.

Type

Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.

Priority

Risk based, weighted by user impact at peak. Anything that causes errors, data loss or an unrecoverable state under load is High. Pure latency regressions are ranked by how far they exceed the agreed budget.

Test data

The specific values, including the invalid and boundary ones.

Expected result

Required

The precise observable outcome, including message text where the wording itself is the requirement.

How To Use This

Remove the load and keep measuring

A smooth ramp to a target number is the least informative test in this set. These four conditions are where systems actually fall over.

Skip the ramp entirely

Go from idle to peak in seconds. Autoscaling policies and connection pools that handle a gentle ramp routinely collapse under an instant spike, which is what a marketing email produces.

Measure the recovery, not just the peak

Push past capacity, then return to normal traffic and keep watching. A system that stays degraded afterwards has a queue or pool it never drains.

Load test at production data volume

A query that is fast against ten thousand rows and unusable against ten million looks perfect on a seeded test database. Volume is part of the test conditions.

Check the numbers, not only the timings

Include balance updates, counters and inventory decrements, then reconcile. A load test that measures only latency will pass while silently corrupting totals.

What Most Sets Miss

Why load tests pass and systems fail

The standard load test is a gradual ramp to a target concurrency, held briefly, reported as an average. Almost every part of that is the wrong shape. Real traffic arrives as a spike rather than a ramp, which is what breaks autoscaling and connection pools. Real peaks last for an hour rather than five minutes, which is what surfaces leaks and queue growth. And an average conceals the slow tail completely, so the report says the system is fast while the 99th percentile is timing out. Percentiles are not a refinement here, they are the measurement.

Recovery is the most commonly skipped case and one of the most informative. Anyone can observe that a system slows down past capacity. The question that matters operationally is whether it returns to baseline when the load goes away, because a system that stays degraded has a bounded resource it is not releasing, and in production that turns a ten minute traffic peak into an outage lasting until somebody restarts something. Related to it are the failure shapes: shedding load with a clear retryable response is a good outcome, while accepting every request and timing all of them out slowly is the worst one.

Dependencies fail more often than capacity does. A downstream service that becomes slow rather than unavailable is the most dangerous case, because unbounded waiting exhausts the thread or connection pool and converts one degraded feature into a total outage. Circuit breakers need testing in both directions, including closing again without a deployment. And retries need backoff with jitter, because synchronised retries from every client prevent the recovery they are trying to achieve.

Finally, caches and data volume are where test environments lie. A system measured only with a warm cache has no headroom at the exact moment it restarts, and a widely shared cache entry expiring under load will be recomputed by every concurrent request at once unless something coalesces them. Both are invisible unless deliberately provoked. The same applies to query behaviour: logging query counts while returning ten, a hundred and a thousand records exposes a query issued per row immediately, and that single pattern is behind a large share of endpoints that are fine in testing and unusable in production.

Suggest an improvement

Need load testing against production scale?

QAble runs performance engagements with realistic traffic shapes and production volume data, reporting percentiles, breaking points and the first symptom at each threshold.

Load and performance testing services

More test case sets

View all

Test cases for a login page

Test cases
25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.

Test cases for a registration form

Test cases
28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.

Test cases for search functionality

Test cases
28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.

Test cases for a shopping cart

Test cases
27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.

Test cases for checkout and payment

Test cases
30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.

Test cases for file upload

Test cases
28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.

Test cases for forgot password

Test cases
26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.

Test cases for OTP verification

Test cases
26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.

Test cases for user roles and permissions

Test cases
26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.

Test cases for form validation

Test cases
27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.

Test cases for a date picker

Test cases
26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.

Test cases for pagination

Test cases
24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.

Test cases for push notifications

Test cases
26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.

Test cases for reports and data export

Test cases
25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.

Test cases for a chatbot

Test cases
28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.

Test cases for net banking transactions

Test cases
28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.

Test cases for wallet and UPI payments

Test cases
28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.

Test cases for insurance claim submission

Test cases
28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.

Test cases for patient records in an EHR

Test cases
28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.

Test cases for CRM lead management

Test cases
28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.

Test cases for an ERP purchase order

Test cases
28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.

Test cases for OTT video playback

Test cases
28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.

Test cases for game level progression

Test cases
28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.

Test cases for a REST API

Test cases
28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.

Test cases for SSO and social login

Test cases
28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.

Test cases for subscription and billing

Test cases
28 cases on mid cycle proration, duplicate and out of order webhooks, renewal double charges, dunning and grace, trials, coupons, metered usage and tax.

Test cases for data tables, filters and sorting

Test cases
28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.

Test cases for session timeout and concurrent login

Test cases
28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.

Test cases for a multi step form wizard

Test cases
28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.

Test cases for email verification

Test cases
28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.

Test cases for dashboards and analytics widgets

Test cases
28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.

Test cases for booking and reservation

Test cases
28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.

Test cases for mobile app install and update

Test cases
28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.

Test cases for accessibility (WCAG 2.2 AA)

Test cases
28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.

Test cases for the OWASP Top 10

Test cases
28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.

Test cases for cross browser compatibility

Test cases
28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.

Test cases for database and data integrity

Test cases
28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.

Test cases for localisation and multi language support

Test cases
28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.

Want your capacity measured, not assumed?

QAble covers load, spike, soak and stress profiles with ISTQB-certified engineers. Start with a free performance audit of your platform.

Talk to QA Advisor