Test cases for forgot password and reset
Updated 2026-11-12 · 4 min read
The reset flow is a common way into other people's accounts, so interviewers like it. These 30 cases cover the request, the email, the link, the new password and the security traps, with a CSV download.
Assumes the flow: user enters an email, receives a link, opens it, sets a new password, then logs in. For an OTP-based reset, apply the same ideas to the OTP (expiry, retries, resend limits).
How to answer in an interview
Split it into four parts: requesting the reset, the email, the link and the new password. Then add the security point most candidates forget: the page must not reveal whether an email is registered, and reset links must be single-use and short-lived.
Request
| ID | Category | Test case | Expected result |
|---|---|---|---|
| F01 | Functional | Request a reset for a registered email | Neutral confirmation shown; email sent |
| F02 | Security | Request a reset for an unregistered email | The same neutral message (no account enumeration) |
| F03 | Negative | Empty email field | Required-field message |
| F04 | Negative | Invalid email format | Format message |
| F05 | Functional | Email typed with different case or surrounding spaces | Still finds the account |
| F06 | Security | Request many resets for the same email in a minute | Rate-limited; the owner is not flooded |
| F07 | Functional | Request twice in a row | The newest link works; earlier links stop working |
| F08 | Negative | Request for an unverified or deactivated account | Behaviour matches the requirement; no sensitive detail leaked |
Email and link
| ID | Category | Test case | Expected result |
|---|---|---|---|
| F09 | Functional | Email arrives within the stated time, correct sender, readable on mobile | Yes |
| F10 | Functional | The link opens the reset page | Yes, over HTTPS |
| F11 | Security | The link contains a long random token, not the email or user id | Token is unguessable |
| F12 | Security | Change one character of the token | Rejected with an "invalid link" page |
| F13 | Security | Use the link after the expiry time (for example 30 minutes) | Expired message and a way to request again |
| F14 | Security | Use the same link a second time after a successful reset | Rejected |
| F15 | Security | Open the link, then log in normally with the old password, then finish the reset | Behaviour defined by the requirement; token should become invalid after use |
| F16 | Security | Check the reset URL is not leaked to third parties (Referer header, analytics) | Not sent |
New password
| ID | Category | Test case | Expected result |
|---|---|---|---|
| F17 | Functional | Set a valid new password and confirm | Success message; user can log in with the new password |
| F18 | Negative | New password and confirmation do not match | Mismatch message |
| F19 | Negative | New password breaks the rules (length, character types) | Rules listed |
| F20 | Negative | New password equals the old password | Rejected if the policy says so |
| F21 | Functional | Log in with the old password after reset | Fails |
| F22 | Security | Existing sessions on other devices after reset | Ended, if the requirement says so |
| F23 | Functional | A confirmation email that the password changed | Sent, with a "not you?" instruction, and no password in it |
| F24 | Negative | Submit the new password twice quickly | One change; no error |
Other
| ID | Category | Test case | Expected result |
|---|---|---|---|
| F25 | Security | Script and SQL text in the email field | Handled safely |
| F26 | Security | Tamper with the request to reset another user's password (change the user id or email in the body) | Server refuses; the token decides whose password changes |
| F27 | UI | The flow on a 360px phone | Readable, no overlap |
| F28 | UI | Show/hide password, strength hints, accessible labels | Present and working |
| F29 | Compatibility | Open the link in a different browser than the one that requested it | Works (the link must not depend on cookies of the first browser) |
| F30 | Functional | The "Back to login" link from every page of the flow | Works |
Downloads
Want a project you can show in interviews?
The portfolio project kit walks you through testing a deliberately buggy app with Selenium or Playwright and API tests, then explaining it. The app itself is free.