Cover four dimensions: functional (valid and invalid credentials, case sensitivity, whitespace trimming), security (rate limiting, lockout, generic error messages, session handling, TLS enforcement), usability and accessibility (keyboard navigation, screen reader labels, password manager support), and cross platform behavior. Then test the surrounding flows: password reset, remember me, expired sessions, and concurrent logins.
Why interviewers ask this
This classic question measures breadth and organization. Anyone can list valid and invalid password cases; the interviewer is watching whether you structure the answer into categories and whether you remember security and accessibility, which are the two most commonly skipped. Mentioning that error messages should not reveal whether an account exists shows a security instinct they specifically look for.
How to structure your answer
- Announce your categories before listing cases.
- Cover the functional happy and unhappy paths quickly.
- Spend real time on security behaviors.
- Add accessibility and cross platform coverage.
- Finish with adjacent flows like reset and session expiry.
Example answer
I would organize it rather than just listing cases, so functional, security, usability, and compatibility. Functionally: valid credentials, wrong password, unknown user, empty fields, case sensitivity on the email, whitespace trimming, and whether the password field is genuinely masked. Security is where I would spend the most time. I check that the error message is identical whether the account exists or not, because a different message for unknown user is a free account enumeration tool. Then rate limiting and lockout behavior, whether the session cookie is set HttpOnly and Secure, whether the session identifier rotates after login to prevent fixation, whether logging out invalidates the session server side rather than just clearing the cookie, and whether login works over plain HTTP. Accessibility next: tab order, labels a screen reader announces, errors associated with their field, and whether a password manager can fill it. Then compatibility across browsers and mobile. Finally the adjacent flows, because that is where bugs hide: reset token expiry and reuse, remember me across restarts, and what happens when a session expires mid action.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How would you test that account lockout cannot be used to lock out other people?
- What would you check about the password reset email itself?
- How would you test login when the identity provider is a third party?
Related qa engineer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions