Hi Testers!, In this article, we will cover “OTP Test Cases“. If the interviewer asks you to write the test cases, do not assume the requirements.
It would be great if you asked for requirements that help you write the best test cases and test scenarios. Let’s get started.
Positive OTP Test Cases
Table of Contents
- Verify that the system generates a valid OTP and delivers it promptly to the user’s registered mobile number/email.
- Verify that the OTP is exactly 6 digits in length and contains only numerical characters.
- Verify that the OTP is unique for each authentication attempt.
- Verify that the OTP remains valid for a specified time period, typically 5 minutes, after generation.
- Verify that the system allows users to request a new OTP if the previous one expires or is incorrect.
- Verify that the OTP input field is case-insensitive, accepting both uppercase and lowercase numerical characters.
- Verify that users receive a confirmation message upon successful OTP validation.
- Verify that the system does not allow reuse of the same OTP for multiple authentication attempts.
- Verify that the system prevents brute-force attacks by limiting the number of OTP attempts within a specific time frame.
- Verify that users can request OTP delivery via both SMS and email, based on their preference.
- Verify that the system displays a user-friendly error message if the OTP input field is left blank during validation.
- Verify that the system allows users to resend the OTP without refreshing the entire authentication page.
- Verify that the OTP delivery mechanism is secure and encrypted, ensuring protection against interception.
- Verify that users receive a notification if the OTP delivery fails, prompting them to request a new OTP delivery method.
- Verify that the system does not display the OTP in any communication, ensuring confidentiality.
- Verify that the OTP input field is disabled after successful OTP validation, preventing multiple submissions.
- Verify that the system validates the OTP input immediately upon submission without requiring users to click an additional button.
- Verify that users receive clear instructions on where to enter the OTP and what to do if they do not receive the OTP.
- Verify that the system generates a new OTP if users request it after the previous OTP has been successfully used.
- Verify that the OTP generation and validation process is logged for security and audit purposes.
Negative OTP Test Cases
- Verify that the system rejects OTPs shorter than 6 digits.
- Verify that the system rejects OTPs longer than 6 digits.
- Verify that the system rejects OTPs containing non-numerical characters.
- Verify that the system rejects expired OTPs during validation attempts.
- Verify that the system rejects OTPs that have already been used for authentication.
- Verify that the system rejects OTPs from invalid or expired delivery methods.
- Verify that the system displays an error message if the OTP input field contains alphabetic characters.
- Verify that the system prevents multiple OTP requests within a short time interval, minimizing the risk of spamming.
- Verify that the system locks the user’s account temporarily after a specified number of incorrect OTP attempts.
- Verify that the system displays a clear error message if the OTP input field is filled with special characters.
- Verify that the system rejects OTPs containing spaces or other whitespace characters.
- Verify that the system rejects OTPs delivered to an email address that is not registered with the user’s account.
- Verify that the system rejects OTPs sent to a phone number that is not associated with the user’s account.
- Verify that the system prevents OTP validation if the user’s account is inactive or blocked.
- Verify that the system does not accept OTPs from unsecured or unreliable delivery channels.
- Verify that the system displays an error message if users attempt to use an OTP that was not requested.
- Verify that the system prevents the reuse of an old OTP for a new authentication attempt.
- Verify that the system does not validate OTPs that were generated for a different user account.
- Verify that the system rejects OTPs if the user’s account has been compromised or flagged for suspicious activity.
- Verify that the system provides a clear error message if users attempt to use an OTP after the allowed validation period has expired.
Final words
So in this article, we have covered “OTP Test Cases”. If you have more, like test cases, you can add them in the comment section below.
