QA interview guide

How Would You Test a Login Page?

If an interviewer asks how would you test a login page, start with the successful sign-in flow, then cover invalid inputs, account states, security abuse, session behavior, UX, accessibility, and backend failures.

Practice this questionView answer examples

Short interview answer: how would you test a login page?

I would test that valid credentials log the user in and redirect correctly, then test invalid credentials, empty fields, locked or disabled accounts, brute-force protection, generic errors, session cookies, logout, remember me, forgot password, keyboard navigation, labels, focus states, screen reader errors, mobile layout, and backend failures.

Functional login test cases

Valid email and password signs the user in successfully.
Successful login redirects to the expected page, such as dashboard or originally requested URL.
Remember me works according to session-duration requirements.
Forgot password and account recovery links are visible and navigate correctly.
Logout works after login and prevents access with the browser back button where required.

Negative login test cases

Invalid password shows a safe error message.
Unknown email does not reveal whether the account exists.
Empty email, empty password, whitespace-only input, and malformed email are validated.
Duplicate submit or slow login response does not create confusing loading states.
Backend error or network failure shows a recoverable message.

Account state test cases

Locked account follows expected lockout messaging and recovery path.
Disabled, inactive, suspended, or blocked account cannot sign in.
Unverified account is handled according to product rules.
MFA-required or SSO-only account routes the user to the correct next step if supported.

Security test cases

Repeated failed attempts trigger rate limiting, throttling, CAPTCHA, or lockout rules.
Login errors are generic enough to avoid account enumeration.
Password is masked and is not exposed in page source, URLs, analytics, or logs.
Session cookie or auth token uses secure settings and is not leaked.
Direct URL access after failed login remains blocked.

Session and redirect test cases

Session is created only after successful login.
Redirect after login is safe and does not allow open redirects.
Session timeout and expired-session behavior are clear.
Remember-me and normal sessions have the expected lifetime.
Logging out invalidates the session and protected pages require login again.

UX and accessibility test cases

Labels, error messages, and password visibility controls are clear.
Keyboard navigation, tab order, submit behavior, and focus states work.
Screen reader users hear field labels and error messages.
Mobile layout is usable without clipping or horizontal scrolling.
Loading state prevents users from wondering whether login is still in progress.

Common mistakes in weak answers

  • Only saying valid login and invalid password.
  • Forgetting locked, disabled, unverified, or MFA-required accounts.
  • Missing brute-force protection and account enumeration risks.
  • Ignoring session cookies, redirects, logout, and browser-back behavior.
  • Skipping accessibility, mobile layout, and backend failure handling.

Senior-style answer example

“I would test valid login, invalid password, unknown email, empty fields, malformed email, locked, disabled, unverified, and suspended accounts, remember me, forgot password, safe redirects, logout, session timeout, browser-back behavior, rate limiting, brute-force protection, generic errors, password masking, no password or token leakage, secure cookies, direct URL access, duplicate submit, slow backend response, mobile layout, keyboard navigation, labels, focus states, and screen reader error announcements.”

Related QA interview practice

Practice advanced login page challengeSee weak vs strong answer examplesHow to test password reset flowQA interview test design questions

Practice this question interactively

Write your own answer, get scored, see what you missed, and compare your response with junior, middle, and senior QA thinking.

Start login practice