Test cases for a registration form
Updated 2026-11-12 · 5 min read
A sign-up form is where bad data enters the system. These 35 cases cover each field, duplicate accounts, password rules, verification and security, with expected results and a CSV download.
Assumes fields for full name, email, mobile number, password, confirm password, a terms checkbox and a "Create account" button, followed by email verification. Remove or add fields to match your product.
How to answer in an interview
Go field by field, then across fields (duplicates, password match), then the flow after submit (verification email), then security. Ask early about the rules: minimum password length, whether the mobile number is mandatory, whether an unverified account can log in.
Field validation
| ID | Category | Test case | Expected result |
|---|---|---|---|
| R01 | Functional | Fill every field with valid data and submit | Account created; confirmation or verification message shown |
| R02 | Negative | Submit with all fields empty | Required-field messages on every mandatory field |
| R03 | Negative | Leave one mandatory field empty at a time | The matching field shows its own message |
| R04 | Boundary | Name of 1 character, the minimum, the maximum and one over the maximum | Limits enforced with clear messages |
| R05 | Functional | Name with spaces, hyphen, apostrophe and unicode (Anne-Marie, D'Souza, प्रिया) | Accepted as valid names |
| R06 | Negative | Name with only digits or symbols | Rejected, or accepted per a documented rule |
| R07 | Negative | Invalid email formats (a@, a@b, a [email protected], a@@b.com) | Format error |
| R08 | Functional | Email with plus-addressing and subdomains ([email protected]) | Accepted |
| R09 | Negative | Mobile number with letters, fewer or more than 10 digits | Rejected with a message |
| R10 | Functional | Mobile with and without +91 or a leading zero | Normalised or accepted as documented |
| R11 | Negative | Leading and trailing spaces in each field | Trimmed before validation |
Password
| ID | Category | Test case | Expected result |
|---|---|---|---|
| R12 | Negative | Password below the minimum length | Rejected with the rule shown |
| R13 | Negative | Password missing a required character type (digit, upper-case, symbol) | Rejected, and the message says which rule failed |
| R14 | Negative | Confirm password does not match | Mismatch message |
| R15 | Functional | Password strength meter updates as you type | Matches the rules |
| R16 | Negative | A very common password (Password@123) | Rejected if there is a blocklist; otherwise noted as a risk |
| R17 | Security | Check that the password is not stored or shown in plain text anywhere (network, email, logs) | Never shown; the confirmation email does not contain it |
Duplicates and flow
| ID | Category | Test case | Expected result |
|---|---|---|---|
| R18 | Negative | Register with an email that already exists | Clear message; consider whether it reveals too much about existing accounts |
| R19 | Negative | Same email with different upper and lower case | Treated as the same account |
| R20 | Negative | Register with an already used mobile number (if unique) | Rejected with a message |
| R21 | Negative | Double click "Create account" | Only one account is created |
| R22 | Functional | Verification email arrives within the stated time with a working link | Account becomes active when the link is opened |
| R23 | Negative | Open the verification link twice, and after it expires | Second use and expired links show a clear message and a way to resend |
| R24 | Functional | Resend verification email | A new link works; the old one is invalid |
| R25 | Negative | Log in before verifying | Blocked or limited, per the requirement |
| R26 | Negative | Untick the terms checkbox | Cannot submit, with a message |
Security, UI and compatibility
| ID | Category | Test case | Expected result |
|---|---|---|---|
| R27 | Security | Script and SQL text in every field | Stored or rejected safely; never executed or echoed unencoded |
| R28 | Security | Many registrations from one IP in a short time | Rate limiting or captcha |
| R29 | Security | Change field values in the request (disable client checks) and submit | Server validates too and rejects bad data |
| R30 | UI | Tab order, labels linked to inputs, error text readable by a screen reader | Accessible |
| R31 | UI | Phone-size screen, and the keyboard type for each field (email, number) | Correct keyboard; no overlap |
| R32 | UI | Browser Back after submit, and refresh after submit | No duplicate account; no re-submission of old data |
| R33 | Compatibility | Repeat R01 on Chrome, Firefox, Safari, Edge | Same result |
| R34 | Functional | Autofill from the browser fills all fields correctly | Works and validates |
| R35 | Performance | Registration under load (for example a marketing campaign) | Stays within the response limit; no duplicates |
Downloads
Want a project you can show in interviews?
The portfolio project kit walks you through testing a deliberately buggy app with Selenium or Playwright and API tests, then explaining it. The app itself is free.