AppReviewX Log in

Login and password reset testing checklist

Wrong passwords, expired links, rate limits, session handling and logout.

updated ·4 min read

In this guide

Login problems create the angriest support emails. This list covers functional checks for sign-in, password reset, rate limits and logout. It is not a security audit; for that, involve a specialist. Each item has the expected result, a reason and how to check.

Login

  1. Log in with correct credentials. Expected: user lands on the right screen. Why: the basic path. How: use a clean install.
  2. Wrong password. Expected: a clear message that does not say which half was wrong, if you want to avoid revealing accounts. Why: informative messages can leak who has an account. How: try wrong password and unknown email, compare the two messages.
  3. Empty email or password. Expected: field-level message. Why: users tap Log in too early. How: submit empty.
  4. Email with different capitalization or trailing space. Expected: still works or is clearly explained. Why: keyboards autocorrect. How: type "Name@Example.com ".
  5. Show/hide password toggle. Expected: reveals and hides, keeps the cursor. Why: typing blindly causes failures. How: toggle mid-typing.
  6. Password manager autofill. Expected: fills both fields and logs in. Why: many users rely on it. How: use the system's saved passwords.
  7. Keyboard "Go/Next" key. Expected: moves to the next field and submits. Why: otherwise users hunt for the button. How: use only the keyboard.

Rate limits and lockout

  1. Several wrong attempts in a row. Expected: a defined response, such as a delay or temporary lock, with a message telling the user what to do. Why: unlimited tries invite abuse, and silent lockouts frustrate. How: try repeatedly, then log in correctly. Compare with your intended rules; this checks behavior, not strength.
  2. Lockout ends. Expected: user can log in again after the stated time. Why: a lock that never ends is a bug. How: wait out the period.

Password reset

  1. Request a reset for a known email. Expected: confirmation message, email arrives. Why: no email, no recovery. How: real inbox, check spam too.
  2. Request a reset for an unknown email. Expected: a message that does not reveal whether the account exists, if that is your policy. Why: avoids leaking accounts. How: compare to item 10.
  3. Reset link works once. Expected: opens the right screen in the app or browser. Why: broken links are the usual failure. How: tap the link on the phone and on a computer.
  4. Reuse the same link. Expected: refused with a way to request a new one. Why: used links should not stay valid. How: open it a second time after a successful reset.
  5. Expired link. Expected: clear message and a new request option. Why: links should expire. How: wait for the stated period or use a test setting.
  6. Request two links; use the older one. Expected: defined behavior, ideally the older one is invalid. Why: confusing otherwise. How: request twice, try the first.
  7. New password rules are shown and enforced. Expected: same rules as sign-up. Why: mismatched rules confuse. How: try short and weak passwords.
  8. Log in with old and new password after a reset. Expected: old fails, new works. Why: confirms the change took effect. How: try both.
  9. Other sessions after a reset. Expected: behavior matches your decision (stay or sign out). Why: users expect old devices to be logged out after a reset. How: stay logged in on a second device, reset, check.

Session and logout

  1. Stay logged in after closing and reopening the app. Expected: still signed in if that is the design. Why: repeated logins annoy. How: kill and reopen.
  2. Log out. Expected: returns to sign-in; Back does not reopen private screens. Why: shared devices. How: log out, press Back or swipe back.
  3. Log out clears local data you intended to clear. Expected: no previous user's content visible. Why: privacy on shared phones. How: log in as user B after user A.
  4. Expired or invalid session. Expected: redirect to login with a message, no data loss from a half-filled form. Why: tokens expire. How: invalidate the token in the backend.

Interruptions

  1. Network lost while logging in. Expected: error and retry. Why: signal drops. How: airplane mode at tap.
  2. Rotate and large text. Expected: fields reachable. Why: keyboards cover buttons. How: enable large text and open the keyboard.
  3. Two-factor step (if you have one). Expected: code works, wrong code is refused, resend works. Why: it is a second login. How: test each case, including an expired code.

AppReviewX offers private, structured feedback on flows like this from other developers; one feedback you write earns one credit. See how AppReviewX works.