Validation Test Generator

Runs in browser Test Design

Describe each input's validation rules and produce test cases proving each rule is enforced and each error message appears, plus valid combinations.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

What is negative testing?

Negative testing gives a system input it should refuse — a missing field, the wrong type, a value outside its range, a malformed file, an expired token, a second click — and checks that it refuses cleanly: a specific error, no data change, no crash, nothing leaked. Positive tests prove a feature works; negative tests prove it fails safely, and edge-case tests prove it still behaves correctly under valid but unusual conditions — an exact limit, a leap day, right-to-left text, a session that expires mid-form. Those paths are where most production incidents and most security findings live. The ISTQB syllabus treats them as part of ordinary test design, not a separate discipline.

Read the guide: How to Write Test Cases

How to use Validation Test Generator

  1. Describe each input with its validation constraints, one per line.
  2. Use natural names (confirmPassword, startDate, endDate) so cross-field rules are detected.
  3. Generate and check the rules table against your specification.
  4. Export the cases to your test management tool.

Validation Test Generator features

  • Detects required, format, type, range, length, item-count, file, pattern, allowed-value, complexity and uniqueness rules
  • A passing and a failing test per rule with the expected message
  • Cross-field rules: confirm password, confirm email, start/end date ordering with the equal-date boundary
  • Error-clears-after-correction usability case per field
  • Critical case proving server-side validation cannot be bypassed
  • Rules table plus numbered cases exportable as Markdown, JSON, CSV or Gherkin

Validation Test Generator example

Validation rules for a password reset form

Input:

password: password, required, min=10
confirmPassword: password, required

Output:

password   Required     ""              "Password is required"
password   Complexity   password        "Password is too weak"
password   Min length   9 chars         "Password must be at least 10 characters"
VAL-013    ConfirmPassword must match password → "Passwords do not match"
VAL-014    Server-side validation cannot be bypassed → API responds 400/422

Frequently asked questions about Validation Test Generator

Which rules are detected?

Required, type/format (email, URL, phone, date, UUID), min/max value, min/max length, item counts, file size and type, pattern, allowed values, password complexity and uniqueness — each with a passing and a failing input and the expected message.

Are cross-field rules supported?

Yes: confirmPassword must match password, an end date cannot precede a start date (with an equal-date boundary), and confirmEmail must match email. Name the fields naturally and the rules are picked up.

Why is there a server-side bypass case?

Front-end validation can be disabled. The generated Critical case sends invalid data straight to the API and expects the same field-level errors.

Can I change the expected messages?

The messages follow a neutral convention ("Email is required"). Replace them in the exported CSV or JSON with your product's copy.

References