Negative Test Generator

Runs in browser Test Design

Define the fields with their types and constraints and get an exhaustive negative test matrix per field, including expected error behaviour.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

What is negative testing?

Negative testing gives a system input it should refuse — a missing field, the wrong type, a value outside its range, a malformed file, an expired token, a second click — and checks that it refuses cleanly: a specific error, no data change, no crash, nothing leaked. Positive tests prove a feature works; negative tests prove it fails safely, and edge-case tests prove it still behaves correctly under valid but unusual conditions — an exact limit, a leap day, right-to-left text, a session that expires mid-form. Those paths are where most production incidents and most security findings live. The ISTQB syllabus treats them as part of ordinary test design, not a separate discipline.

Read the guide: How to Write Test Cases

How to use Negative Test Generator

  1. Describe the fields with their types and constraints, one per line.
  2. Optionally name the form or endpoint.
  3. Generate to see the matrix and the numbered test cases.
  4. Run the same payloads against the API to confirm server-side validation.

Negative Test Generator features

  • Per-field negative matrix: empty, null, whitespace, wrong type, out of range, too long, bad format, unknown enum value, duplicates
  • Security rows for every text field: script and SQL injection, null bytes, bidi overrides
  • File, list, date, phone, URL, email, UUID and password specific failure modes
  • Expected behaviour spelled out: message, no persistence, field highlighting
  • Whole-form cases: everything invalid at once and completely empty submission
  • Export as Markdown, JSON, CSV or Gherkin

Negative Test Generator example

Negative matrix for an age field

Input:

age: integer, min=18, max=120, required

Output:

Empty value            ""       Rejected with "Age is required"
Non-numeric text       "abc"    Rejected with "Age must be a number"
Decimal value          18.5     Rejected with "Age must be a whole number"
Below minimum (18)     17       Rejected with "Age must be at least 18"
Above maximum (120)    121      Rejected with "Age must be at most 120"
Extremely large value  1e309    Rejected with "Age is out of range"

Frequently asked questions about Negative Test Generator

What negative inputs are generated?

Empty, null and whitespace values, wrong types, values outside min/max, too long or too short, bad formats (email, URL, phone, date, UUID), values outside an enum, duplicates for unique fields, file type and size violations, plus injection, null-byte and bidi payloads.

What does "expected behaviour" contain?

A concrete expectation: the error message the user should see, that nothing is saved, and that the field is highlighted. Adjust the wording to your product's message catalogue.

Should I test negative cases through the API as well?

Yes. Client-side validation can be bypassed, so send the same invalid payloads directly to the endpoint and expect a 400/422 with field-level errors.

Why are security rows included?

Any field that accepts text is a potential injection point. The matrix adds script, SQL, null-byte and bidi checks so they are never forgotten.

References