What is Negative Testing? Test cases With Example
Thomas Hamilton
⚡ Smart Summary
Negative Testing checks how a software application behaves when it receives unexpected input data or operating conditions, so the product degrades gracefully instead of crashing, corrupting data or exposing a security hole.
Negative Testing
Negative Testing is a software testing type used to check a software application against unexpected input data and conditions. Unexpected data or conditions range from a wrong data type in a simple form field to a deliberate hacking attack. The purpose of negative testing is to prevent the application from crashing on invalid input and to improve the quality and stability of the product.
Positive testing alone only proves that the system works under normal conditions. Negative testing confirms that the same system also handles abnormal conditions, which is what a fault-tolerant product requires.
Example of Negative Testing
A lift is the example most often used to explain negative testing, because its normal behaviour and its failure behaviour are both easy to picture.
The requirements of a lift are familiar: pressing a floor number sends the lift to that floor, and the door opens automatically once the lift reaches the specified floor.
Some negative scenarios for the same lift are listed below, next to the assumption that positive testing makes instead.
| Negative Testing | Positive Testing |
|---|---|
| What happens if the number of persons (weight) exceeds the specified limit? | Assumes only the specified number of persons will enter the lift |
| What happens if someone smokes or causes a fire inside the lift? | Assumes there will be no smoke or fire inside the lift |
| What happens if there is a power failure during operation? | Assumes there will be no power failure while the lift is working |
All of these cases fall under negative testing. None of them can be guaranteed never to happen, so each one has to be contained.
Suppose the overweight condition is never checked, and the lift behaves abnormally once it is overloaded. That single gap damages the reliability of the system and can even endanger life. This is what negative testing means in practice, and why it matters.
Software behaves the same way. A negative test deliberately deviates from the normal operational procedure. Consider a registration form.
| Negative Testing | Positive Testing |
|---|---|
| Enter an invalid email id in the email field | Only valid email ids are entered in an email field |
| Enter an invalid phone number, such as characters, in a phone number field | Only numbers are entered in the number field |
| Upload an image with a size outside the specified boundary | Only images within the specified size boundary are uploaded |
| Upload invalid files such as XML or SQL files in an image upload field | Only valid image formats such as .jpg or .png are uploaded |
Each of these negative cases must still leave the system working. If a character is typed into a number field, the application cannot process the unexpected data it was never expecting, and it may crash. Worse, an SQL injection string in the same field could erase the contents of the database. Losses of that kind are the reason negative testing exists.
Why do Negative Testing?
Testing consumes time and money, so deciding what, how and how much to test matters. The case for spending part of that budget on negative testing looks different from the two sides of a project.
Organization perspective
Delivering a good quality product to the client is the responsibility of the organization, and negative testing is part of that obligation. It is also the organization’s evidence that it did everything reasonable to prevent a failure, even though no system is completely error free.
Impact is the deciding factor. An e-commerce site may pass every positive test and still contain a loophole that lets an attacker run an SQL injection and erase the data behind it. That is a serious security breach, and only negative testing looks for it.
Public-facing applications, websites in particular, offer almost no control over how visitors use them, so negative testing is the only way to confirm that unusual usage is covered and contained. The same applies to malicious users: attackers actively look for an opportunity to break a system, and hacking scenarios belong squarely in negative test coverage.
Client perspective
Clients expect a product with zero vulnerabilities, and negative testing is what supports that expectation. For sensitive products such as e-commerce or online stock trading, security testing and negative testing are mandatory rather than optional.
The client’s only real concern is cost. Once the impact of a failure is analysed, the client is in a position to decide how far the negative testing effort should go.
How to do Negative Testing
Negative testing starts by considering every input the application can physically receive, not only the inputs it is supposed to receive. Each of those belongs in a Test Case even when it is obviously the wrong way to use the feature. An email field is tested with everything that is not a valid email address, and an image upload control is tested with every file type that is not an image.
The list of possible invalid inputs is effectively endless, so negative test cases have to be prioritised. For an image field that accepts only .png files, the candidate uploads include .jpeg, .xml, .xls and many others. An XML or SQL file has a far greater potential impact than a .jpeg, so those cases are executed first. Ranking cases by impact before execution is what keeps negative testing affordable.
Most negative test cases come from a small set of established design techniques rather than from improvisation:
- Boundary values: exercise the values immediately outside a valid range, such as 0 and 101 for a field that accepts 1 to 100.
- Invalid equivalence classes: pick one representative from each class of rejected input, for example letters in a numeric field.
- Error guessing: use experience of past defects to target the inputs most likely to break this kind of feature.
- Malformed and hostile data: script tags, SQL fragments and oversized payloads that probe validation and security handling.
- Fuzz testing: generate large volumes of random or mutated input automatically to find unhandled crashes.
- Interrupted flows: cancel, refresh, time out or lose connectivity part-way through a transaction.
Whichever technique produces the case, the expected result must be written down as a controlled, readable failure — a validation message, a rejected upload, a clean rollback — and never merely as “the system does not crash”.
Pros and Cons of Negative Testing
Like every other testing technique, negative testing has advantages and drawbacks that depend on where, when and how much of it is applied.
Advantages of Negative Testing
- It protects product quality directly, because a good quality product is one with no exploitable vulnerabilities.
- It widens coverage. Invalid input reaches a live system intentionally or accidentally, so negative cases have to run alongside positive ones for coverage to be meaningful.
- It increases client confidence before a release goes live.
- It surfaces defects that positive testing structurally cannot reach, such as unhandled exceptions and weak input validation.
Disadvantages of Negative Testing
- In some situations it is a waste of time and energy. If an application is built for a single user, the case of 100 simultaneous users is not worth testing, so choosing the right conditions matters and some systems need very little negative testing at all.
- It requires skilled and experienced people to design the cases.
- From the client’s point of view it adds cost and can delay the release.
- It competes for effort. A team that spends heavily on negative testing may end up under-investing in positive testing.
