QA interview guide

How would you test user registration?

User registration combines form validation, account creation, email verification, security, permissions, and backend data. A strong answer shows you can test the user journey and the system state it creates.

Practice this scenarioBrowse all questions

Write your own answer and compare it with senior QA coverage.

What interviewers expect

What interviewers expect

Interviewers expect valid registration, required fields, password confirmation, terms acceptance, duplicate email, email verification, role defaults, password hashing, safe responses, and accessibility.

Checklist

Checklist

Use these practical prompts to build a complete answer. Strong interview responses usually include functional behavior, negative cases, security, backend/data risks, UX, accessibility, and reliability.

Functional checks

  • Registration page loads and accepts valid name, email, password, confirm password, and terms.
  • Account is created with correct default role, status, timestamps, and welcome or onboarding state.
  • Verification email is sent, verification link activates the account, and user can log in after verification.

Validation and negative cases

  • Missing name, email, password, confirm password, and terms are rejected.
  • Invalid email, weak password, password mismatch, duplicate email, already registered user, and expired verification link are handled.
  • Double submit, concurrent registration, malformed JSON, database error, and email provider failure are recoverable.

Security and backend risks

  • Password is hashed, not returned, not logged, and not exposed in analytics.
  • Users cannot set admin role, protected fields, tenant id, status, or other mass-assignment fields.
  • Rate limiting, user enumeration, CAPTCHA, API status codes, response schema, and audit logs are verified.

UX, accessibility, and performance

  • Browser autofill, mobile layout, loading state, clear errors, and resend verification email work.
  • Labels, keyboard navigation, focus states, screen reader errors, and terms link accessibility are checked.
  • High signup volume and slow email provider behavior remain reliable.

Complete interview coverage checklist

Aim to mention 20-40 concrete checks. This expanded list helps you turn a short answer into a structured senior-style response.

Registration page loads and accepts valid name, email, password, confirm password, and terms.
Account is created with correct default role, status, timestamps, and welcome or onboarding state.
Verification email is sent, verification link activates the account, and user can log in after verification.
Missing name, email, password, confirm password, and terms are rejected.
Invalid email, weak password, password mismatch, duplicate email, already registered user, and expired verification link are handled.
Double submit, concurrent registration, malformed JSON, database error, and email provider failure are recoverable.
Password is hashed, not returned, not logged, and not exposed in analytics.
Users cannot set admin role, protected fields, tenant id, status, or other mass-assignment fields.
Rate limiting, user enumeration, CAPTCHA, API status codes, response schema, and audit logs are verified.
Browser autofill, mobile layout, loading state, clear errors, and resend verification email work.
Labels, keyboard navigation, focus states, screen reader errors, and terms link accessibility are checked.
High signup volume and slow email provider behavior remain reliable.
Structure your answer: Start with valid registration and expected account creation.
Structure your answer: Add required fields, invalid formats, password rules, confirm password, terms, and duplicate email.
Structure your answer: Add email verification, login after verification, resend link, and expired verification link.
Structure your answer: Add security, backend persistence, role defaults, mass assignment, rate limiting, accessibility, and reliability.
Do not miss: Email verification and resend behavior.
Do not miss: Mass assignment and role escalation.
Do not miss: Password storage and sensitive response data.
Do not miss: Terms, consent, and accessibility of linked policies.

Ready to practice?

Practice this scenario interactively

Write your own answer and compare it with senior QA coverage.

Practice this scenario

Answer structure

Strong answer structure

  1. Start with valid registration and expected account creation.
  2. Add required fields, invalid formats, password rules, confirm password, terms, and duplicate email.
  3. Add email verification, login after verification, resend link, and expired verification link.
  4. Add security, backend persistence, role defaults, mass assignment, rate limiting, accessibility, and reliability.

Common missed areas

Common missed risks

Email verification and resend behavior.
Mass assignment and role escalation.
Password storage and sensitive response data.
Terms, consent, and accessibility of linked policies.

Answer template

Use this interview answer template

I would start with successful registration using required fields, then cover invalid email, weak password, password confirmation, terms, duplicate email, email verification, default role/status, password hashing, protected fields, backend errors, UX, accessibility, and rate limiting.

Use it as a structure, then replace the examples with specific checks for the feature you are discussing.

Common weak answer

“I would test valid and invalid cases.”

This is too generic because it does not show risk thinking. A stronger answer names the happy path, negative cases, security risks, backend/data behavior, UX/accessibility, and reliability concerns that matter for this exact scenario.

Examples

Weak answer vs stronger answer

Weak answer
“I would test valid email and password.”

This is relevant but too narrow. Registration also needs name, confirm password, terms, email verification, duplicate handling, security, backend persistence, and accessibility.

Stronger answer
“I would test registration with valid name, email, password, confirm password, and accepted terms, account creation, default role and status, verification email, account activation, login after verification, missing required fields, invalid email, weak password, password mismatch, terms not accepted, duplicate email, already registered user, expired verification link, resend verification email, password hashed, password not returned, user cannot set admin role, mass assignment blocked, API status codes, response schema, database error, email provider failure, double submit, audit logs, metrics, accessibility, mobile layout, and browser autofill.”

FAQ

Frequently asked questions

What should I mention first when answering "How would you test user registration?"

Start with valid registration and expected account creation.

Should I include negative and edge cases?

Missing name, email, password, confirm password, and terms are rejected. Invalid email, weak password, password mismatch, duplicate email, already registered user, and expired verification link are handled.

Should I include security, API, or backend risks?

Password is hashed, not returned, not logged, and not exposed in analytics. Users cannot set admin role, protected fields, tenant id, status, or other mass-assignment fields.

What are common missed risks?

Email verification and resend behavior. Mass assignment and role escalation. Password storage and sensitive response data. Terms, consent, and accessibility of linked policies.

How can I practice this answer?

Use the interactive how would you test user registration? challenge to write your own answer, get checklist-based feedback, and compare your coverage with stronger QA thinking.

Practice

Practice this scenario interactively

Write your own answer and compare it with senior QA coverage.

Practice this scenario