QAble

Browse by type

Explore all services
Functional
Functional Testing
End-to-end feature validation
Software Testing
Full-stack QA across disciplines
Software QA
Process, standards & audit QA
Independent Testing
Vendor-neutral V&V & sign-off
Cyber Security Testing
Pen testing & exploit validation
Enterprise Testing
ERP, CRM & core platform QA
Manual Testing
Human-driven QA testing
Exploratory Testing
Discover hidden edge cases
User Acceptance Testing
Business-aligned validation
Usability Testing
Real user experience testing
UI/UX Testing
Interface & interaction QA
Accessibility Testing
WCAG compliance testing
Accessibility Audit
Compliance gap assessment
Accessibility Remediation
Fix accessibility violations
Digital Accessibility
End-to-end inclusive design QA
Security & VAPT
Vulnerability assessment
VAPT Testing
Penetration testing & compliance
Performance Testing
Load & stress testing
Non-Functional Testing
Performance, security & reliability
Compatibility Testing
Cross-device & browser QA
Scalability Testing
Capacity & growth QA
Agile Testing
Sprint-aligned QA
Localization Testing
Language & regional QA
Digital Testing
Digital experience QA

What's New

Solution

Tesbo-X, Playwright Automation Framework

Intelligent test selection, parallel CI execution, and rich trace reporting unified in a single automation system.

Try for Free →
View all services
About UsWhy QAbleCertificationsCareers
Knowledge HubBlogQAble WeeklyCase StudiesEbooksUtilities
BetterBugs
BetterBugs
Tesbo-X
Tesbo-X
Talk to QA Advisor
Browse the Knowledge Hub74 resources
/Test Cases/Registration form test cases

Test cases

Registration test cases, including the identity cases

Twenty eight cases for a signup form: field validation, password rules, duplicate accounts, verification link handling, bot protection and accessibility. The cases that find real defects here are about identity, not about empty fields.

28cases/7coverage types/8security cases/FreeCSV download

All 28 test cases, ready to copy

Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.

Last updated

28 worked examples

REG-01

Register successfully with valid details

TypeFunctionalPriorityHigh
Test data
Unused email, compliant password, all required fields
Expected result
Account created in unverified state, verification email queued, user informed to check email. No session granted yet if verification is required first.
REG-02

Reject registration when a required field is empty

TypeNegativePriorityHigh
Test data
Each required field left blank in turn
Expected result
Submission blocked, error shown against the specific field, previously entered values preserved.
REG-03

Reject a malformed email address

TypeNegativePriorityHigh
Test data
user@, @domain.com, user@domain, user domain.com, user@@domain.com
Expected result
Each value rejected with a field level message. No account created.
REG-04

Accept valid but unusual email formats

TypeBoundaryPriorityMedium
Test data
[email protected], [email protected], unicode local part if supported
Expected result
Accepted. Plus addressing and subdomains are valid and are wrongly rejected by many hand written validators.
REG-05

Attempt to register an email that already exists

TypeSecurityPriorityHigh
Test data
Email belonging to an existing account
Expected result
No new account created. Response does not confirm the address is registered. Preferred behaviour is a neutral message plus an email to the existing owner telling them a signup was attempted.
REG-06

Check registration does not leak account existence through timing or wording

TypeSecurityPriorityHigh
Test data
Existing email versus unused email, compare responses and timings
Expected result
Message text, status code and response time are indistinguishable between the two cases.
REG-07

Reject a password below the minimum length

TypeBoundaryPriorityHigh
Test data
Minimum length minus one character
Expected result
Rejected with the rule stated. Requirements shown before submission, not only after.
REG-08

Accept a password at the maximum supported length

TypeBoundaryPriorityMedium
Test data
Maximum allowed length, then maximum plus one
Expected result
Maximum accepted and login with it succeeds. Maximum plus one rejected clearly rather than silently truncated, because silent truncation breaks the next login.
REG-09

Reject a password that fails complexity or breach checks

TypeSecurityPriorityHigh
Test data
password123, the user own email as password, a known breached password
Expected result
Rejected with guidance. Breach list checking is preferred over arbitrary character class rules.
REG-10

Confirm password mismatch is caught

TypeNegativePriorityMedium
Test data
Password and confirmation differing by one character
Expected result
Blocked with a message on the confirmation field. Neither value cleared.
REG-11

Verify the account through the emailed link

TypeFunctionalPriorityHigh
Test data
Fresh verification link
Expected result
Account moves to verified, link is consumed, user lands on a signed in state or a clear next step.
REG-12

Reuse a verification link that has already been used

TypeSecurityPriorityHigh
Test data
Link opened a second time
Expected result
Rejected as already used. No state change. Message does not expose account details.
REG-13

Use an expired verification link

TypeBoundaryPriorityHigh
Test data
Link older than the configured expiry
Expected result
Rejected with an option to request a new link. Old token invalidated.
REG-14

Attempt privileged actions before verification

TypeSecurityPriorityHigh
Test data
Unverified account attempting the actions verification is meant to gate
Expected result
Blocked server side, not only hidden in the interface. This is the most commonly missed case on this feature.
REG-15

Request a new verification email repeatedly

TypeSecurityPriorityHigh
Test data
Resend requested ten times in a minute
Expected result
Throttled after a small number of attempts, with a stated wait. Prevents using your service to spam a third party.
REG-16

Submit the form twice in quick succession

TypeStatePriorityHigh
Test data
Double click submit, or replay the request
Expected result
Exactly one account created. Second attempt is rejected or treated as idempotent, never producing a duplicate record.
REG-17

Register with leading or trailing whitespace in the email

TypeBoundaryPriorityMedium
Test data
" [email protected] "
Expected result
Trimmed and accepted, and the same normalisation applied at login so the account remains reachable.
REG-18

Register with mixed case in the email

TypeFunctionalPriorityHigh
Test data
[email protected] then [email protected]
Expected result
Treated as one identity. The second attempt is a duplicate, not a second account.
REG-19

Enter names with apostrophes, hyphens and non Latin characters

TypeBoundaryPriorityMedium
Test data
O'Brien, Anne-Marie, non Latin script names, names of one character
Expected result
Accepted and stored without corruption, and displayed correctly afterwards. Overly strict name validation is a real accessibility and inclusion defect.
REG-20

Attempt script and SQL payloads in text fields

TypeSecurityPriorityHigh
Test data
<script>alert(1)</script>, ' OR 1=1 --, template expression payloads
Expected result
Stored safely and rendered as text everywhere it appears later, including admin views and emails. No execution, no query error.
REG-21

Bypass client side validation

TypeSecurityPriorityHigh
Test data
Direct request to the registration endpoint with invalid values
Expected result
Server rejects with the same rules as the interface. Client validation is convenience only.
REG-22

Register while a required consent or terms checkbox is unchecked

TypeNegativePriorityHigh
Test data
Terms unchecked, marketing consent unchecked
Expected result
Terms enforced server side. Marketing consent defaults to off and is stored as given, since consent records are a compliance artefact.
REG-23

Complete registration with the automated bot protection active

TypeFunctionalPriorityMedium
Test data
Normal user completing the challenge, then a scripted submission
Expected result
Genuine user passes without excessive friction. Scripted submission is blocked. Verify the challenge has an accessible alternative.
REG-24

Navigate the whole form by keyboard only

TypeAccessibilityPriorityHigh
Test data
Tab, Shift Tab, Space and Enter only
Expected result
Logical focus order, visible focus indicator, all controls reachable, form submittable with Enter.
REG-25

Check errors are announced to a screen reader

TypeAccessibilityPriorityHigh
Test data
NVDA or VoiceOver with a deliberately invalid submission
Expected result
Errors are programmatically associated with fields and announced. Colour is not the only indicator of an invalid field.
REG-26

Verify password manager and autofill behaviour

TypeCompatibilityPriorityMedium
Test data
Browser and mobile password managers
Expected result
Autocomplete attributes allow a generated password to be saved. Paste is not blocked, since blocking paste actively discourages strong passwords.
REG-27

Interrupt registration mid form on mobile

TypeStatePriorityMedium
Test data
Background the app or rotate the device with the form half complete
Expected result
Entered values preserved, no duplicate submission on resume.
REG-28

Register when the email service is unavailable

TypeNegativePriorityHigh
Test data
Mail provider returning errors or timing out
Expected result
Either the account is created with a clear path to resend verification, or the transaction fails cleanly with nothing half created. An account that exists but can never be verified is the failure to avoid.

What goes in each field

ID

Required

Stable identifier, prefixed by module.

Test case

Required

What is being verified, in one line.

Type

Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.

Priority

Risk based. Duplicate account handling, enumeration and verification bypass are High regardless of how unlikely the path looks, because each one has a direct security or data integrity consequence.

Test data

The specific values, including the invalid and boundary ones.

Expected result

Required

The precise observable outcome, including message text where the wording itself is the requirement.

How To Use This

Start with duplicates and verification

Empty field validation is caught by anyone using the form once. These four areas are where signup actually breaks.

Test the duplicate path first

What happens when the email exists is the single most consequential behaviour on this form, for both users and security.

Try to act before verifying

Call the endpoints an unverified account should not reach. Interfaces hide those actions; servers often still allow them.

Submit twice, fast

Double submissions create duplicate accounts, duplicate welcome emails and duplicate analytics events.

Break the email provider

An account that exists but can never be verified is a support ticket you cannot resolve. Test with mail failing.

What Most Sets Miss

Where registration defects actually live

The duplicate email case is where correctness and security collide. Telling the user the address is already registered is friendly and also confirms to anyone who asks that an account exists, which is the first step of a credential stuffing campaign. The behaviour that satisfies both concerns is a neutral response plus an email to the real owner, and it is worth deciding deliberately rather than inheriting whatever the framework does.

The verification bypass case is the one we find most often on client work. The interface hides the features that require a verified account, and the endpoints behind them accept requests anyway. Test at the API layer, with a token from an unverified account, and check every action verification is supposed to gate.

Case sensitivity and whitespace on the email field cause a specific and confusing bug: registration normalises the address one way, login normalises it another, and the account becomes unreachable. Register with mixed case and trailing spaces, then log in with the clean value, and confirm they resolve to the same identity.

Finally, name validation. Rules that reject apostrophes, hyphens or non Latin characters are a genuine defect that excludes real people, and they show up in almost every hand written validator. Include those cases and treat failures as bugs rather than as edge cases.

Suggest an improvement

Building authentication?

QAble tests signup, login and account recovery as one flow, including the security cases that only appear when you call the API directly.

Functional testing services

More test case sets

View all

Test cases for a login page

Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.

Test cases for search functionality

Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.

Test cases for a shopping cart

Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.

Test cases for checkout and payment

Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.

Test cases for file upload

Test cases28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.

Test cases for forgot password

Test cases26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.

Test cases for OTP verification

Test cases26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.

Test cases for user roles and permissions

Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.

Test cases for form validation

Test cases27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.

Test cases for a date picker

Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.

Test cases for pagination

Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.

Test cases for push notifications

Test cases26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.

Test cases for reports and data export

Test cases25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.

Test cases for a chatbot

Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.

Test cases for net banking transactions

Test cases28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.

Test cases for wallet and UPI payments

Test cases28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.

Test cases for insurance claim submission

Test cases28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.

Test cases for patient records in an EHR

Test cases28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.

Test cases for CRM lead management

Test cases28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.

Test cases for an ERP purchase order

Test cases28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.

Test cases for OTT video playback

Test cases28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.

Test cases for game level progression

Test cases28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.

Test cases for a REST API

Test cases28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.

Test cases for SSO and social login

Test cases28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.

Test cases for subscription and billing

Test cases28 cases on mid cycle proration, duplicate and out of order webhooks, renewal double charges, dunning and grace, trials, coupons, metered usage and tax.

Test cases for data tables, filters and sorting

Test cases28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.

Test cases for session timeout and concurrent login

Test cases28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.

Test cases for a multi step form wizard

Test cases28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.

Test cases for email verification

Test cases28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.

Test cases for dashboards and analytics widgets

Test cases28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.

Test cases for booking and reservation

Test cases28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.

Test cases for mobile app install and update

Test cases28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.

Test cases for accessibility (WCAG 2.2 AA)

Test cases28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.

Test cases for performance and load

Test cases28 cases on spikes with no ramp, recovery after peak, soak and leak detection, pool exhaustion, cold caches, retry storms and data correctness under load.

Test cases for the OWASP Top 10

Test cases28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.

Test cases for cross browser compatibility

Test cases28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.

Test cases for database and data integrity

Test cases28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.

Test cases for localisation and multi language support

Test cases28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.

Test cases for outbound webhooks

Test cases28 cases on retry backoff and dead letter stores, one dead consumer degrading the pipeline, payload signing and replay windows, out of order delivery and endpoint SSRF.

Test cases for background jobs and queues

Test cases28 cases on work outliving the visibility timeout, idempotent handlers, poison messages, priority starvation, scheduler overlap across instances and graceful drain.

Test cases for real time features and websockets

Test cases28 cases on messages lost in the reconnect gap, half open connections, per channel authorisation, tokens expiring mid connection, backpressure and fanout across instances.

Test cases for file storage and media processing

Test cases28 cases on signed URL scope and expiry, serving before scanning completes, content type sniffing, metadata stripping, orphaned objects and derivative failures.

Test cases for CSV import and bulk operations

Test cases28 cases on reruns duplicating successes, delimiters inside quoted fields, byte order marks, leading zeros, ambiguous dates and bulk action scope.

Test cases for feature flags and progressive rollout

Test cases28 cases on unreachable flag services, unstable bucketing, rollouts that reshuffle users, kill switch latency, server and client mismatch and stale flags.

Test cases for Android app lifecycle and permissions

Test cases28 cases on state lost to process death, configuration changes, permanent permission denial, revocation while backgrounded, doze and battery restrictions.

Test cases for iOS app lifecycle and permissions

Test cases28 cases on the keychain surviving uninstall, suspended termination, limited photo access, allow once location, app switcher snapshots and biometric invalidation.

Test cases for wearable app sync

Test cases28 cases on data recorded away from the phone, duplicate records on resync, full buffers, clock drift, health permissions, battery budgets and unworn readings.

Test cases for VR and AR experiences

Test cases28 cases on the frame rate comfort floor, tracking loss, guardian boundaries, involuntary camera movement, AR anchor drift and spatial data privacy.

Test cases for IoT device pairing and telemetry

Test cases28 cases on offline buffering and reconnect floods, fleet wide reconnection storms, shared credentials, wrong device clocks and stale queued commands.

Test cases for embedded firmware update

Test cases28 cases on power loss mid write, automatic rollback and health confirmation, signature and anti rollback checks, staged rollouts and recovery mode.

Test cases for user profile and account settings

Test cases28 cases on partial saves reported as success, optimistic updates the server rejected, mass assignment through a profile form, avatar content inspection and session invalidation.

Test cases for account deletion and data export

Test cases28 cases on export links that must be authorised and expiring, deletion cascading to storage, caches, logs and processors, grace periods, legal holds and deadlines.

Test cases for consent and cookie management

Test cases28 cases on cookies and tracking requests firing before consent, reject parity with accept, tag manager bypass, withdrawal, cached banners and server side forwarding.

Test cases for notification preferences and delivery

Test cases28 cases on opt outs honoured on one channel and ignored on another, marketing sent as transactional, unsubscribe scope, imports resetting consent and digest timezones.

Test cases for admin impersonation and support access

Test cases28 cases on actions attributed to the customer instead of the admin, credential exposure, chained and upward impersonation, session expiry and immutable access records.

Test cases for audit logs and activity history

Test cases28 cases on forged entries through log injection, immutability and tamper detection, actor attribution across impersonation and jobs, retention and legal holds.

Sources

Want your signup flow tested properly?

QAble covers authentication end to end with ISTQB-certified engineers. Start with a free QA audit of your product.

Talk to QA Advisor