A Login page is more than just the entry point to a user account—it’s a key area for security, privacy, and personalization. It’s also one of the most important screens to validate during software testing or web testing. If you’re unsure where to start, here are 100 Login Page test cases you can use as references.
This article covers the most common and essential login test cases, grouped by category. A test case template is also included to help you get started quickly.
Read More: A Complete Web Testing Checklist
Positive test cases verify that the Login page behaves correctly with valid inputs. Common scenarios include:
Negative test cases check how the Login page handles invalid or unexpected input. Common scenarios include:
Performance testing checks whether the Login page can handle different levels of traffic. This matters especially for high-traffic sites like ecommerce, financial services, public services, or institutions with seasonal spikes (e.g., school enrollment).
Key performance test cases include:
Read More: Performance Testing vs Load Testing
The Login page is the first security barrier for most systems, controlling access and protecting user data. Security testing verifies that vulnerabilities are closed—either through in-house checks or authorized penetration testing.
Essential security test cases include:
SQL Injection occurs when malicious SQL code is inserted into a web application’s input fields to manipulate or damage the database. It remains one of the most common web hacking techniques, even decades after its discovery.
Suppose you have a login page at https://example.com/login. If the backend doesn’t properly sanitize user input, the system becomes an easy target for SQL Injection. Here’s a simple example of vulnerable Python code:
username = get_user_input()
password = get_user_input()
# Vulnerable SQL query
query = "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'"
print(query)This approach has two critical issues:
Because of this, an attacker can bypass authentication with just two inputs:
# Attacker inputs:
username: user
password: ' OR '1'='1
# Resulting SQL query:
SELECT * FROM users
WHERE username='user'
AND password='' OR '1'='1';The resulting query executed by the database becomes:
SELECT *
FROM users
WHERE username='user'
AND password=''
OR '1'='1'; Test cases for the Gmail Login page are similar to any other Login page:
Read More: 100 Test Cases For Registration Page
Here we enter the domain of mobile testing, which comes with its own unique challenges. Devices vary widely in model, resolution, and mobile-specific behavior. Here are several login page test cases tailored for mobile apps:
Read More: Top API Test Cases You Should Test
BDD testing is an approach where test cases are written in simple language—usually Gherkin—so even non-technical team members can understand them. A typical BDD test uses three statements:
Here are 15 Login Page test cases written in Gherkin format:
Test Case 1: Successful Login
Given a valid username and password,
When I attempt to log in,
Then I should be successfully logged into the system.
Test Case 2: Invalid Password
Given an invalid password for a valid username,
When I attempt to log in,
Then I should see an error message indicating the incorrect password.
Test Case 3: Empty Username Field
Given an empty username field,
When I attempt to log in,
Then I should see an error message indicating the username field is required.
Test Case 4: Empty Password Field
Given an empty password field,
When I attempt to log in,
Then I should see an error message indicating the password field is required.
Test Case 5: Username with Special Characters
Given a username with special characters,
When I attempt to log in,
Then I should successfully log in.
Test Case 6: Locked Account
Given a locked account due to multiple failed login attempts,
When I attempt to log in,
Then I should see an account-locked error message.
Test Case 7: Remember Me Option
Given valid credentials with “Remember Me” selected,
When I log in,
Then I should remain logged in across sessions.
Test Case 8: Multi-Factor Authentication (MFA)
Given valid credentials with MFA enabled,
When I log in,
Then I should be prompted to enter an authentication code.
Test Case 9: Password Reset Request
Given a password reset request,
When I follow the reset process,
Then I should be able to set a new password.
Test Case 10: Account Recovery Request
Given an account recovery request,
When I follow the recovery steps,
Then I should regain access to my account.
To write effective test cases, it helps to start with a test case template. We've prepared PDF, Doc, and Excel versions for easy download. Choose your preferred format below and begin documenting your test cases instantly.
Or Manage All Test Cases in Katalon TestOps
Login page testing isn’t overly complex, but it is highly repetitive. Because it’s a critical user entry point, frequent regression testing is essential. While automation is a smart strategy, building scripts from scratch and updating them after every UI change often becomes inefficient.
With Katalon Platform, you can create, manage, run, maintain, and report on all your tests in a single place, no additional tools required.
For example, the Record-and-Playback feature lets you interact with the Login page while Katalon automatically generates a complete test script. Within seconds, you have a reusable automated test.
As shown in the video below, simply click the “Make an Appointment” button and Katalon will capture the action, convert it into code, and execute it when you hit “Run”:
Even when the Login page changes, Katalon updates outdated locators automatically using its Self-healing features. Combined with its AI-powered testing capabilities, the platform provides a comprehensive, scalable, and modern approach to software quality management.