Guides & Tutorials
Plain-language explanations of the concepts behind the tools — what they are, when to use them and how to avoid the usual mistakes. By the Mutqan Soft QA team.
Start here
The overviews the rest of the guides build on.
QA knowledge areas
Each area starts with an overview and continues with the pages that go deeper into one part of it.
Performance & Security Resilience Testing
Performance & Security Resilience Testing
How to test a product under load, failure and attack: load, stress and soak tests with real targets, failure injection, the OWASP baseline and what to record.
PerformanceResilience Testing
What resilience testing is, how it differs from performance testing, and how to run it: requirements, fault experiments, patterns, tools and a game-day plan.
SDLC and STLC Explained
SDLC and STLC Explained
How the software development lifecycle and the testing lifecycle fit together: QA in every phase, an SDLC-to-STLC map, shift-left and testing per model.
Test DesignSoftware Testing Life Cycle (STLC)
The STLC phase by phase — analysis, planning, design, environment, execution and closure — mapped to the ISTQB test process, with entry and exit criteria.
Static Testing
Static Testing
Static testing explained: static vs dynamic testing, reviews and inspections, static analysis tools and their limits, and how to find defects early.
Test DesignSoftware Review Types
Informal review, walkthrough, technical review and inspection compared, with the generic review process, the six review roles and success factors.
Requirement AnalysisHow to Review Requirements
How to review requirements and user stories: an 8-point checklist, red-flag words, a worked example with review comments, and where AI tools help.
Test Strategy: A Practical Guide
Test Strategy: A Practical Guide
What a test strategy is, how it differs from a test plan, what it contains, the main test approaches, how to choose them, and an example outline.
Test DesignHow to Write a Test Plan
How to write a test plan: what it contains, entry, exit, suspension and resumption criteria, a copy-ready template, an agile one-page plan and an example.
Test DesignRisk-Based Testing
How to run risk-based testing: identify product risks, score likelihood and impact, set test depth, choose regression tests and report residual risk.
Test DesignTest Estimation Techniques Explained
How to estimate testing effort: why estimates fail, effort factors, ratio, extrapolation, Delphi, three-point and WBS, with a worked example.
Test DesignTest Metrics That Drive Decisions
Which test metrics are worth tracking — coverage, execution, defect and DORA delivery metrics — how to report them, and how to avoid vanity metrics.
Defect Lifecycle
Defect Lifecycle
The defect lifecycle explained: error vs defect vs failure, states, transitions, resolutions, retesting vs regression, aging, metrics, an example.
Bug AnalysisHow to Write a Bug Report
How to write a bug report developers can act on: the fields that matter, a copy-ready template, a worked example, severity vs priority, and mistakes to avoid.
Bug AnalysisDefect Triage
How to run defect triage: participants, cadence, a checklist per defect, a severity × priority matrix, assignment, root cause analysis and anti-patterns.
Exploratory Testing
Exploratory Testing
Exploratory testing explained: how it differs from scripted testing and how to run it with charters, heuristics, oracles, tours and good notes.
Test DesignSession-Based Test Management (SBTM)
How to run session-based test management: write charters, time-box sessions, keep session sheets, track test, bug and setup time, and debrief well.
Accessibility Testing
Accessibility Testing
Accessibility testing with WCAG 2.2: POUR, levels A/AA/AAA, WCAG-EM, manual vs automated checks, sprint and CI practice, and typical defects.
Test DesignKeyboard Accessibility Testing
How to test keyboard accessibility: WCAG 2.2 criteria, focus order and visibility, traps, skip links, APG key patterns, dialogs, test cases, defects.
Test DesignScreen Reader Testing
Screen reader testing: semantics, accessible names, headings and landmarks, ARIA rules, live regions, an NVDA/VoiceOver/TalkBack routine, defects.
Test DesignAccessible Forms Testing
How to test web forms for accessibility against WCAG 2.2: labels, required fields, grouping, errors, autocomplete, redundant entry and accessible login.
Test DesignVisual Accessibility Testing
How to test contrast, use of colour, alt text, resize and reflow, text spacing, target size, motion and dark mode against WCAG 2.2, with checklists.
AutomationAutomated Accessibility Testing
What automated accessibility checks can and cannot decide, ACT rules, common engines, running checks in unit, E2E and CI, triage, baselines and WCAG-EM.
Mobile Testing: A Practical Guide
Mobile Testing: A Practical Guide
How to test mobile apps: app types, device fragmentation, a device matrix, interruptions, networks, permissions, security, accessibility and automation.
Test DesignMobile App Test Scenarios
Mobile test scenarios to reuse: install and update, permissions, interruptions, network changes, offline sync, resources, push notifications and gestures.
AutomationMobile Test Automation Explained
How mobile test automation works: Appium, Espresso and XCUITest compared, accessibility-id locators, sources of flakiness, device farms and CI pipelines.
UI Test Automation
UI Test Automation
UI test automation in practice: framework layers, Selenium, Playwright and Cypress, locators, waits, assertions, page objects, test data, CI and strategy.
AutomationLocator Strategies for UI Tests
How to choose UI test locators: role and label first, then test ids, CSS and XPath; dynamic ids, iframes, shadow DOM, anti-patterns and a checklist.
AutomationFlaky Tests
What makes UI tests flaky — timing, shared state, data, environment, third parties — how to diagnose them, and a sane retry and quarantine policy.
CI/CD Testing
CI/CD Testing
How testing works inside CI/CD pipelines: test stages, fast-feedback ordering, quality gates, JUnit reports, sharding, flaky tests and failure triage.
Test DesignSmoke vs Sanity vs Regression Testing
Smoke, sanity and regression testing compared: scope, timing, depth and automation, why "sanity" is ambiguous, and how to select regression tests.
AutomationDeployment Verification Testing
How to verify a deployment: a plan written in advance, post-deploy smoke tests, synthetic checks, canary releases, feature flags, signals and rollback.
Database Testing for QA Engineers
Database Testing for QA Engineers
How to test a database: CRUD checks through UI and API, constraints, referential integrity, consistency, test data, performance and security.
DatabaseSQL for Testers
Practical SQL for QA: count and sum reconciliation, orphan and duplicate detection, NULL and date checks, dialect differences and safe practice.
DatabaseTesting Transactions and DB Migrations
How to test database transactions and migrations: atomicity, isolation levels and anomalies, concurrency, and safe schema and data migrations.
Localization Testing
Localization Testing
Localization testing explained: i18n vs l10n, translation quality, plurals, pseudo-localization, Hijri dates, digits, currencies, Unicode and automation.
Test DataRTL Testing for Arabic Interfaces
How to test right-to-left Arabic interfaces: dir and lang, what mirrors and what does not, CSS logical properties, bidi text, Arabic rendering and forms.
LLM Testing: How to Test LLM Applications
LLM Testing: How to Test LLM Applications
How to test LLM applications: non-determinism, prompt and output evaluation, security, RAG, regression on model changes, metrics and AI risk frameworks.
Test DesignLLM Evaluation: How to Evaluate LLM Outputs
How to evaluate LLM outputs: success criteria, golden datasets, code, human and model graders, rubrics, repeated runs and regression on every change.
Test DesignLLM Security Testing: Prompt Injection and More
Defensive security testing for LLM apps: prompt injection, data disclosure, excessive agency and output handling, with benign test cases per OWASP 2025.
Test DesignRAG Testing: Retrieval, Grounding, Citations
How to test RAG systems: measure retrieval apart from generation, check groundedness, citations, "I don’t know" answers, freshness and access control.
Comparisons
Two approaches side by side, on facts you can check.
Manual vs Automated Testing
Manual and automated testing compared on cost, speed, what each finds and misses, and maintenance — with a practical rule for deciding what to automate.
API TestingAPI Testing Approaches Compared
Five ways to test an API — exploratory, scripted, contract, mocking and load — compared on what each catches, and how REST, GraphQL, SOAP and webhooks differ.
Test DesignIn-House QA Team vs Outsourced QA
In-house, outsourced, augmented and hybrid QA compared on cost, ramp-up, product knowledge, control, data protection and knowledge retention, with a checklist.
All guides
What is JSON?
JSON explained in plain language: what it is, the six value types, the syntax rules that trip people up, how to format and validate it, and JSON vs XML/YAML.
API TestingWhat is API Testing? How to Test a REST API
API testing explained: what it is, what to check in every request and response, a step-by-step method for a REST API, common failures and free browser tools.
Test DesignHow to Write Test Cases
How to write test cases developers trust: the fields every case needs, a copy-ready template, a login example, and the design techniques that find real bugs.
SecurityWhat is a JWT? JSON Web Tokens Explained
JWT explained simply: the three parts of a JSON Web Token, claims like exp and sub, how to decode and verify one, why decoding is not verifying, and security.
EncodingWhat is Base64? Encoding Explained
Base64 explained: what it is and is not, how the encoding works, why output grows by a third, Base64 vs Base64URL, the = padding, and how to encode and decode.
UtilitiesWhat is a UUID? v4 vs v7, UUID vs GUID & ULID
UUIDs explained: the 128-bit format, v4 vs v7, why v7 is better for database keys, UUID vs GUID vs ULID, collision odds, and how to generate and validate them.
WebHTTP Status Codes Explained
Every HTTP status code class explained with the codes you actually meet — 200, 301, 401, 403, 404, 422, 429, 500, 502, 503, 504 — causes and which to return.
UtilitiesCron Expressions Explained
Cron expressions explained field by field: minute, hour, day, month, weekday, the *, /, - and , operators, common schedules, time zones and classic mistakes.
UtilitiesRegular Expressions (Regex) for Beginners
Learn regex from scratch: character classes, quantifiers, anchors, groups and flags, copy-ready patterns for emails, phones and dates, and how to test safely.
PerformanceWhat is Performance Testing?
Performance testing explained: load vs stress vs spike vs soak tests, the metrics that matter (p95, throughput, error rate), planning a first test, and tools.
PDF Editing & AnnotationHow to Edit a PDF Without Uploading It
Edit a PDF without uploading it: what "in the browser" means, what you can change, when to convert to Word instead, and how to check nothing left your device.
PDF OptimizationPDF Compression Explained
Why a PDF is large (images, fonts, duplicated objects), what lossless and lossy compression change, how to pick a quality, and when a file cannot get smaller.
Test DesignDate and Time Testing
Date and time testing: inject a clock, simulate future dates, shift test data, and test month ends, leap days, time zones, DST, timestamps and 2038.
Web UtilitiesWhat Is an IBAN?
What an IBAN is: country code, check digits and BBAN, the 24-character Saudi format, how the MOD-97 check works, and how to test IBAN fields safely.