Negative Test Generator

Runs in browser Test Design

Define the fields with their types and constraints and get an exhaustive negative test matrix per field, including expected error behaviour.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use Negative Test Generator

  1. Describe the fields with their types and constraints, one per line.
  2. Optionally name the form or endpoint.
  3. Generate to see the matrix and the numbered test cases.
  4. Run the same payloads against the API to confirm server-side validation.

Negative Test Generator features

  • Per-field negative matrix: empty, null, whitespace, wrong type, out of range, too long, bad format, unknown enum value, duplicates
  • Security rows for every text field: script and SQL injection, null bytes, bidi overrides
  • File, list, date, phone, URL, email, UUID and password specific failure modes
  • Expected behaviour spelled out: message, no persistence, field highlighting
  • Whole-form cases: everything invalid at once and completely empty submission
  • Export as Markdown, JSON, CSV or Gherkin

Negative Test Generator example

Negative matrix for an age field

Input:

age: integer, min=18, max=120, required

Output:

Empty value            ""       Rejected with "Age is required"
Non-numeric text       "abc"    Rejected with "Age must be a number"
Decimal value          3.5      Rejected with "Age must be a whole number"
Below minimum (18)     17       Rejected with "Age must be at least 18"
Above maximum (120)    121      Rejected with "Age must be at most 120"
Extremely large value  1e309    Rejected with "Age is out of range"

Frequently asked questions about Negative Test Generator

What negative inputs are generated?

Empty, null and whitespace values, wrong types, values outside min/max, too long or too short, bad formats (email, URL, phone, date, UUID), values outside an enum, duplicates for unique fields, file type and size violations, plus injection, null-byte and bidi payloads.

What does "expected behaviour" contain?

A concrete expectation: the error message the user should see, that nothing is saved, and that the field is highlighted. Adjust the wording to your product's message catalogue.

Should I test negative cases through the API as well?

Yes. Client-side validation can be bypassed, so send the same invalid payloads directly to the endpoint and expect a 400/422 with field-level errors.

Why are security rows included?

Any field that accepts text is a potential injection point. The matrix adds script, SQL, null-byte and bidi checks so they are never forgotten.