Q7 of 38 · Test design
What is the difference between positive and negative testing?
Short answer
Short answer: Positive testing verifies the system works as expected with valid inputs and intended use. Negative testing verifies it handles invalid inputs, error conditions, and unexpected use without crashing or corrupting data. Both belong in any test plan.
Detail
Positive testing follows the happy path. Given the spec says "users with a valid email and 8+ character password can log in," positive testing tries alice@x.com / password123 and confirms login succeeds. The goal is to verify that the documented contract works.
Negative testing tries to break the system. Empty fields, invalid emails, SQL-injection attempts, expired sessions, racing requests, malformed payloads, fields at boundary +/- 1. The goal is to verify the system handles the unexpected gracefully — error messages, validation, fail-safe behaviour. Negative testing is where most bugs hide.
A balanced test plan typically has positive cases enough to cover the spec's stated behaviour (often 1-3 per requirement) and significantly more negative cases, because there are many ways to be invalid for each way to be valid.
Common categories of negative tests:
- Invalid input — wrong type, out of range, missing required fields, empty when not allowed.
- Security — injection, XSS, CSRF, broken auth, malformed tokens.
- Resource limits — large payloads, deeply nested JSON, very long strings.
- Sequencing / state — actions in wrong order, concurrent edits, double-submit.
- Network / environment — slow connection, dropped requests, unavailable third party.
The senior signal: a test plan that's roughly 30% positive, 70% negative — because the negative space is much larger than the positive.