What is Negative Testing?

Negative testing verifies that a system handles invalid input, unexpected conditions, and misuse gracefully, returning proper errors instead of crashing, corrupting data, or exposing vulnerabilities.

Start a Free Mock Interview

Free to start · 7-day trial on paid plans

IN DEPTH

In depth.

Positive (happy-path) testing confirms the system works with valid input. Negative testing, sometimes called sad-path or failure testing, confirms it behaves correctly when things go wrong: empty fields, wrong data types, out-of-range values, malformed payloads, expired tokens, duplicate submissions, and dependency failures.

Negative testing is closely tied to boundary value analysis and equivalence partitioning, which help generate invalid classes systematically rather than guessing. For APIs it means asserting correct status codes (400, 401, 403, 409, 422) and clear error messages; for UIs it means validation messages and disabled actions; for security it overlaps with input validation against injection and overflow.

The skill interviewers look for is judgment: you cannot test every invalid input, so you choose high-risk, high-likelihood negative cases. Strong testers think like an adversary and like a confused user simultaneously, covering both malicious and accidental misuse.

WHY IT MATTERS

Why interviewers ask about this.

Many defects and security issues live on the unhappy path. Interviewers ask about negative testing to see whether you design for failure, not just confirm the happy path, which separates thorough testers from box-tickers.

EXAMPLE

Example scenario.

A signup form passes all happy-path tests. Negative testing reveals that submitting an existing email returns a 500 instead of a friendly 409, an empty password is accepted client-side but rejected with a stack trace server-side, and pasting 10,000 characters into the name field times out the request. Each is a defect the happy path never touches.

TIP

Interview tip.

Give a concrete negative case you caught and tie your approach to boundary value analysis and equivalence partitioning. Mention expected error codes/messages, that shows you test the failure contract, not just that it "errors".

FAQ

Frequently asked questions.

What is the difference between positive and negative testing?

Positive testing checks the system works with valid input on the happy path. Negative testing checks it handles invalid input and unexpected conditions gracefully, with proper errors and no crashes or data corruption.

How do you decide which negative cases to test?

Use boundary value analysis and equivalence partitioning to enumerate invalid classes, then prioritize by risk and likelihood, you cannot test every invalid input, so focus on high-impact, high-probability misuse.