Form testing covers valid completion, invalid input, keyboard use, recovery and the data finally sent to the server.
On this checklist
Fields and validation
- Labels describe each field and remain visible.
- Required and optional fields are clear.
- Accepted formats and examples are accurate.
- Client and server validation agree.
- Invalid values cannot bypass validation through a direct request.
- Whitespace, case, Unicode and localisation behave consistently.
- Conditional fields appear and become required at the correct time.
Boundaries and formats
| Area | Test data |
|---|---|
| Length | Empty, 1, minimum−1, minimum, maximum, maximum+1 and very long. |
| Numbers | Zero, negative, decimal, leading zeros, separators and extremes. |
| Dates | Leap day, month/year edge, past/future limits and timezone. |
| Email / phone | Valid variations, spaces, case, country code and malformed input. |
| Text | Accents, emoji, apostrophes, line breaks and script-like text. |
Keyboard, autofill and paste
- Tab order is logical and focus is visible.
- Enter submits only when appropriate.
- Space and arrow keys work for native controls.
- Copy, cut and paste follow requirements.
- Password managers and browser autofill fill the intended fields.
- Autofilled values trigger validation and dependent updates.
- Mobile keyboards use suitable input modes.
Error handling
- Error appears close to the field and is programmatically associated.
- Message explains the problem and how to fix it.
- Entered valid values remain after an error.
- Focus moves to an error summary or first invalid field as designed.
- Error clears when corrected, not prematurely.
- Server and network failures allow safe retry.
Submission and data
- Single click creates one submission.
- Double click, refresh and back navigation do not create duplicates.
- Submit button shows progress and prevents unsafe repeat actions.
- Sent payload contains correct field names, values and encoding.
- Success message, redirect, email and stored data agree.
- Reset or cancel warns before losing important data.
- Sensitive data is not placed in URLs, logs or analytics.
Practical flow: submit once through the UI, inspect the Network payload and response, then verify the saved record.