In our project we have a user to sign on after filling the CAPTCHA code. Right now it's working fine and I am a beginner to this field.

I am confused how to write a test case for the CAPTCHA code

  • 2
    Are you testing the captcha generator, or are you testing a web page that incorporates a 3rd party captcha generator to sign-in? Sep 23, 2012 at 6:30
  • @BjRollison sir i am testing the captcha code generator Sep 24, 2012 at 4:46
  • How do you know it's working fine if you don't know how to test it yet?
    – Trish Khoo
    Sep 24, 2012 at 13:59
  • @TrishKhoo its working fine in terms i have checked with invalid captcha code.valid captcha code..etc,the process after the validation of captcha code works fine,right now i am seeking answers for writing test cases mam Sep 24, 2012 at 14:31

5 Answers 5


Many of the preceding answers are directed at testing the behavior of the captcha from a customers POV (enter valid, invalid, etc.). But, if you are testing an actual captcha generator that your dev's wrote then you should go deeper. Also, there is some important information about the captcha generator you're testing that would be important for functional testing.

For example,

  • Will you need to test your hash function for collisions?
  • Rather then trying to create a "dummy captcha" I would recommend trying to use a robot to successfully read the captcha.
  • Also, does your captcha employ a proxy block if the IP address is hidden?
  • Which fonts are used, and are they used with sufficient randomness?
  • Which characters are used (e.g. upper and lower case, numbers, etc) in a captcha?

Some other information needed for behavioral testing from the UI could include

  • Does your captcha have audio for sight impaired customers?
  • Captcha resets/or getting new captcha.
  • Does the width of the bitmap of the captcha displayed to the user vary, and if so how does it appear on different resolutions?
  • Readability of captcha by human vs. robot.
  • Input validation?
  • 1
    "Rather then trying to create a "dummy captcha" I would recommend trying to use a robot to successfully read the captcha." So, if the robot cannot read the captcha, that's an indicator of a "successful" captcha, right? Sep 26, 2012 at 15:48
  • 1
    Not necessarily...but it reduces the risk that the captcha generator will produce a captcha that can be read by robots. I will also say that building a dummy captcha generator and automating via the UI is a lot of overhead with little overall value since validating the generated captcha codes can be more efficiently done at the unit/component level. Sep 26, 2012 at 16:17
  • In fact, captcha approach was re-used to support digitalizing of books, since OCR software had problems to recognize characters.
    – dzieciou
    Jan 5, 2013 at 9:31

There are two questions here: (1) test case itself; (2) ability to automate testing.

As per the first topic, you just describe it in a form of Actor - Action - Result, e.g.:

  • System redirects to a page XX
  • User types CAPTCHA code into a field [...]
  • System checks answer validity
  • If the key is not valid, System redirects to Step N
  • System redirects to "Completion" page

or, alternatively (depending on your policy of writing TC's):

  • System redirects to a "CAPTCHA" page
  • User types a valid code into a field [...]
  • System redirects to "Completion" page
  • Alt flow at Step N
    • User types an invalid CAPTCHA code into a field [...]
    • System redirects to Step N

Automating this process is slightly different. Since the key to testing is ability to reproduce, you can't afford different CAPTCHA's within the same test. However, you can (and should) make tests for valid, invalid, empty responses.

For this purpose, you should develop a dummy CAPTCHA provider that will have exactly the same interface as the "production" CAPTCHA provider has, but will return only a well-known image(s).
Then, your automated code will attempt "solving" this CAPTCHA with various answers (valid, invalid, empty, and so on).

  • 1
    Upvote for suggesting the use of stub/dummy/mock object Sep 26, 2012 at 14:03

The purpose of a CAPTCHA is to verify a human is submitting the form. By definition, if you could automate this interaction, the functionality would fail. But you didn't ask about automation, so that's just an aside.

Think about it from a functional perspective - does it let you submit when you enter the right input? Does it keep you out if you don't enter the right input? What kinds of invalid input might trick it into letting you in?

Think about it from a usability perspective - is the CAPTCHA easy enough for a human to read? Is it still tough enough for a program to detect and read?

Do some research about CAPTCHAs and how they've been known to succeed and fail. That may give you ideas about how to test.

Have a look at this testing Cheat Sheet for some more ideas. If you're a beginner, it may help you with future tests too.


Example for manual testing, if you mean it:

  • TC1: try to enter the captcha right, expected: you are allowed
  • TC2: try to enter the captcha wrong, expected: you are not allowed
  • TC3: try to enter the captcha with Upper/Lower Case Mix, expected (depends on reqs, mostly): you are allowed
  • TC4: try to proceed without entering, expected: you are not allowed.

For me the CAPTCHA consists of different sub-modules:

  • generation of the CAPTCHA content as text representation plus some random elements like colors/noise that is added to the image.
  • generation of a CAPTCHA image that will be presented to the user
  • CAPTCHA decision logic/controller that decides if CAPTCHA is entered ok/not ok/create a new CAPTCHA

If implemented via interfaces (dependency injection) you can test some functionality in isolation:

  • with a mocked generator you can make regression tests that make sure that a given set of "generated CAPTCHA" result in the same image as previons so you can bitcompare the images.
  • you can unit test the generator that every generation fullfills your requirement:
    • number of characters in the generated string
    • type of allowed/disallowed chars

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.