What is Performance Testing?
Performance testing checks how a system behaves under a particular workload: how fast it responds, how many requests it can handle, whether it stays stable over time and what happens when it is pushed past its limits. Functional tests answer "does it work?"; performance tests answer "does it still work at 9 am on launch day with ten thousand users?".
This guide explains the types of performance test and when each is used, the metrics to measure and how to read them, a practical plan for a first test of an API or web application, and the tools that run the load.
Types of performance test
- Load testing — the expected, realistic traffic (average and peak) to confirm the system meets its response-time and error targets under normal conditions.
- Stress testing — traffic pushed beyond the expected peak until something breaks, to find the limit and see whether the failure is graceful (slow, 503s) or catastrophic (crashes, data corruption).
- Spike testing — a sudden jump from low to very high traffic, as in a marketing campaign or a flash sale, to check autoscaling and queueing.
- Soak (endurance) testing — moderate load for hours or days, to catch memory leaks, connection pool exhaustion and disk growth that short tests never show.
- Scalability testing — increasing load in steps to learn how throughput and latency change as resources are added.
- Benchmarking — a quick, repeatable measurement of one endpoint to compare two versions or two implementations.
Try it: HTTP Request Benchmark Try it: API Performance Comparator
The metrics that matter
- Response time — measured per request. Report percentiles, not the average: p50 (median), p95 and p99 tell you what most users and the unluckiest users experience. An average hides the slow tail.
- Throughput — requests per second (or transactions per second) the system sustains.
- Error rate — percentage of requests that fail (5xx, timeouts, connection errors). It must stay near zero at the target load.
- Concurrency — how many virtual users or open connections are active at once.
- Resource usage — CPU, memory, database connections, queue depth on the server side, correlated with the load timeline.
- Apdex or SLO compliance — the share of requests inside the agreed budget (for example 95% under 300 ms).
Try it: Response Time Analyzer Try it: Response Size Analyzer
Planning a first performance test
- Define the goal as a number: "checkout completes in under 800 ms at p95 with 500 concurrent users and less than 0.1% errors".
- Pick the critical journeys — login, search, add to cart, checkout, the top three API endpoints — rather than every page.
- Model realistic traffic: the mix of journeys, think time between actions, ramp-up and steady state. Use production analytics if you have them.
- Prepare test data at scale: thousands of distinct users, products and payloads so caches and unique constraints behave as in production.
- Run in an environment that resembles production in size, or scale the results deliberately. A laptop-sized database will not tell you about a production one.
- Establish a baseline first with a single user, then ramp. Compare every later run against the baseline.
- Monitor the server side during the run; the client-side numbers alone cannot tell you why it got slow.
Try it: Load Test Data Generator Try it: Concurrent Request Test Generator
Tools: JMeter, k6, Gatling and browser tools
Apache JMeter is the long-standing open-source choice with a GUI, recorders and CSV data sets; k6 is script-based (JavaScript), lightweight and CI-friendly; Gatling is Scala/Java-based with excellent reports; Locust is Python-based. Cloud services (BlazeMeter, Grafana Cloud k6, Azure Load Testing) run the same scripts from many regions.
A browser cannot generate production-scale load, but browser tools are ideal for the steps around a load test: measuring a single endpoint's response time distribution, comparing two endpoints, checking payload size and compression, and generating the CSV and JSON data files the runners consume.
Try it: JMeter Test Data Generator Try it: JMeter CSV Generator Try it: HTTP Request Benchmark
Reading the results
- Latency rising while throughput flattens means a bottleneck was reached — CPU, a database, a connection pool or a downstream API.
- Error rate climbing before latency does often means a limit (max connections, rate limit) rather than slowness.
- p99 far above p95 points at garbage collection pauses, lock contention or a slow dependency hit by a few requests.
- Slow degradation during a soak test is a leak: memory, file handles or connections.
- A result that cannot be reproduced on a second run is noise; fix the environment before tuning the code.
Try it: API Performance Comparator Try it: Cache Header Analyzer
Common mistakes
- Testing with one user id or one product — everything hits the cache and the numbers are fantasy.
- Ramping to full load instantly, then blaming the system for a spike it was not designed for.
- Reporting averages. Always report p95 and p99 with the error rate.
- Running the load generator on the same machine as the system under test.
- Ignoring payload size: a 2 MB JSON response is slow no matter how fast the server is.
- Testing once before launch and never again. Performance regresses one commit at a time.
Try it: Response Size Analyzer Try it: Load Test Data Generator
Frequently asked questions
What is the difference between load testing and stress testing?
Load testing applies the expected traffic to confirm targets are met; stress testing keeps increasing traffic past the expected peak to find the breaking point and see how the system fails.
What is a good API response time?
It depends on the use, but common budgets are under 100 ms for cached reads, under 300 ms for typical API calls and under 1 s for heavy operations — measured at p95, not on average.
Why use p95 instead of the average response time?
Averages hide the slow tail. p95 says 95% of requests were at least this fast, which is what users notice; p99 shows the worst realistic case.
How many virtual users do I need?
Derive it from real traffic: peak requests per second multiplied by the average request duration gives the concurrency you must sustain. Add headroom of 20–50% for growth.
Can I performance-test from a browser?
You can measure and benchmark individual endpoints and compare two of them, which is useful during development. Production-scale load needs a dedicated tool such as JMeter, k6 or Gatling running on separate machines.
Which is better, JMeter or k6?
JMeter has a GUI, recorders and the largest ecosystem; k6 is code-first, lighter and integrates naturally with CI. Teams comfortable with JavaScript often prefer k6; teams with existing JMeter plans keep JMeter.
Tools mentioned in this guide
Measure an endpoint's response time over several samples: min, max, average, median and p95.
Run a small, safe benchmark against a public endpoint (bounded requests and concurrency) and get throughput and latency percentiles.
Compare response times and sizes of two endpoints (e.g. v1 vs v2, staging vs production) side by side.
Analyze response size: raw vs compressed bytes, headers size, JSON structure weight and largest fields.
Generate large parameter datasets (users, tokens, ids, payloads) for k6, JMeter, Gatling and Locust load tests.
Generate JMeter-ready test data (CSV Data Set Config files and User Defined Variables) from a field schema.
Generate CSV files for JMeter CSV Data Set Config with correct quoting, delimiters and encodings.
Generate concurrency test scripts (k6, JMeter JMX, Locust, Artillery, Node.js) with safe defaults for a target endpoint.
Analyze Cache-Control, Expires, ETag, Last-Modified, Vary and Age headers and explain how browsers and CDNs will cache the response.