Testing & QA

A practice site with 25 real bugs planted inside for you to find. Unlike automation practice sites it targets manual exploratory testing: you find the bugs and report them.

A RESTful API built to improve your API automation testing. Unlike simple mock APIs, it has realistic behaviour such as token authentication and rate limiting.

A series of challenges, tutorials and references for practising API testing, by Alan Richardson (EvilTester). Unlike ordinary mock APIs it comes with a task list, marking your progress as you complete each challenge.

A visual regression testing platform that compares screens with visual AI. Unlike pixel-by-pixel tools, it ignores trivial differences such as anti-aliasing and flags real changes.

An automation practice site with a UI, an API backend and a ready list of test cases. Unlike single-page demo sites, it offers end-to-end flows — sign-up, cart, checkout — together with their API.

A resource list for Appium, the mobile-app test-automation tool. Unlike platform-specific tools such as Espresso or XCUITest, it drives Android and iOS from one API over the WebDriver protocol.

A list of plugins and resources for AVA, the JavaScript test runner. Unlike Jest, it runs test files concurrently in separate processes by default.

A resource list for CodeRabbit, the AI-powered code-review platform. Unlike general AI code-review lists, it gathers only CodeRabbit configurations and sample rules; the company maintains it itself.

A resource list for Gatling, the Scala-based load- and performance-testing framework. Unlike JMeter, you write scenarios in code (Scala, Java, Kotlin) rather than clicking them together in a GUI.

A resource list for JMeter, the load- and performance-testing tool. Unlike general performance-testing lists, it gathers only JMeter plugins, integrations and guides.

A resource list for k6, the developer-centric load and performance testing tool. Unlike general performance lists it focuses on one tool and its scripting ecosystem.

A list of tools, plugins and examples for the Playwright ecosystem. Unlike the official docs it brings together community tooling and real project examples.

A list of visual-regression tools that verify changes did not break functionality or style. Unlike unit tests, they compare screenshots and catch style breakages that code assertions cannot see.

A collection of the Selenium browser-automation framework and its surrounding tools. Unlike scattered search it gathers language bindings, grid and plugins in one place.

A list of target sites and APIs for practising test automation: demo shops, forms, trap-laden pages and fake APIs, grouped by kind. Rather than repeating dozens of interchangeable demo sites, this directory keeps a few representatives and points here for the rest.

A list gathering test-automation frameworks, tools and resources by language and platform. Unlike scattered searches it collects them all in one organised place.

A list gathering every branch of software testing — unit, end-to-end, performance, contract — with resources. Unlike a single tool list, it pairs books and testing theory with the tools; you can also find the rest of this field’s practice sites here.

A test site that serves subdomains with deliberately broken TLS setups (expired, self-signed, wrong host and so on). It tests clients, not servers: whether your browser or HTTP library rejects these errors correctly.

Spins up a mock REST endpoint in seconds and intercepts or fakes HTTP requests. Unlike writing your own mock server, it needs no code or setup.

Live-test your site across different browsers and operating systems.

Analyses code alongside its change history, surfacing the files that churn most, carry most complexity or depend on one person. Unlike static analysers, it accounts for the dimension they miss: time.

A simple public GraphQL API serving country, continent and language data, with no key required. Unlike REST-based mock APIs, it suits practising GraphQL queries and client testing.

A French test site that grades the TLS setup of HTTPS, SMTP and XMPP servers by cipher suite, certificate and key exchange. Unlike SSL Labs it covers mail and messaging servers as well as web.

A Google tool that flags bypassable rules (unsafe-inline, broad wildcards, missing directives) when you paste in a Content-Security-Policy header. securityheaders.com grades headers in general; this looks only at the CSP, directive by directive, from an XSS angle. Unlike general header graders, it looks only at the CSP, directive by directive.

An end-to-end testing framework that runs in the browser with live reload and time-travel debugging. Unlike Selenium the test runs in the same browser loop as the app; compared with Playwright, multi-tab and cross-browser support is more limited.

A fake JSON REST API offering dozens of resources for quick prototyping and test data. Unlike JSONPlaceholder it has richer data (products, carts, recipes) plus authentication, pagination and search.

A fake e-commerce REST API with products, carts and users for front-end prototypes. Unlike general mock APIs such as JSONPlaceholder, its data model is e-commerce-specific.

A test API with OAuth2 authentication and write support, over REST and GraphQL. Unlike read-only fake APIs it truly lets you exercise create/update flows.

A scanner that gathers a domain's DNS, email (SPF/DKIM/DMARC), TLS and web-header security into one report. Unlike tests that measure a single layer it shows the whole external surface together; a public one-off scan is free, continuous monitoring is paid.

A page that grades your browser's TLS client setup (version, cipher suites, known weaknesses). SSL Labs tests a server; this tests your side, the browser and OS, and the result is also available as a JSON API. SSL Labs tests a server, whereas this checks the client side.

An HTTP testing service that echoes headers, body and response. Unlike mock REST APIs, it tests HTTP itself — headers, cookies, redirects, compression — rather than data.

A clean API client for REST, GraphQL and gRPC requests. Unlike Postman it is lighter and open source, and can be versioned with git.

A zero-setup test API that returns realistic fake JSON on request. Unlike running your own mock it is instantly available — the standard for prototypes and tutorials.

A low-code test automation tool for web, API and mobile. Unlike code-first frameworks such as Playwright, it builds scenarios with record-and-playback and a visual editor, no coding needed; advanced features are paid.

An email sandbox that captures outgoing mail before it reaches real recipients. Unlike testing against a real SMTP server, it makes accidentally emailing a customer impossible.

Mozilla's in-browser checker that scores a site's headers, cookies and TLS settings against security best practice; it now lives inside MDN. Unlike securityheaders.com it keeps a rescan history and is backed by an open-source scanner (http-observatory).

A hub bringing together community, learning resources and events for software testers. Unlike tool-focused sites, it centres on the craft itself — exploratory testing, test strategy, careers.

An API serving movie and series data, handy for tests and prototypes. Since IMDb has no public API, it is the common alternative; the free key is limited to 1,000 requests a day.

Microsoft’s cross-browser (Chromium, Firefox, WebKit) automation and testing framework, driving all three from one API. Unlike Selenium, it waits automatically and talks to the browser over its own protocol rather than WebDriver.

A large, deeply nested REST API serving Pokémon data — popular for tests and tutorials. Unlike simple fake APIs its rich, related data model lets you exercise realistic queries.

A desktop/cloud tool to build, store as collections and test API requests. Unlike curl it saves requests, holds environment variables and runs automated test sequences.

A realistic tool-shop demo with both a UI and a REST API, designed for end-to-end testing. Unlike older demos it runs on a modern stack (React + API + Swagger).

Code review as a service from vetted professional reviewers; since HackerOne acquired it, it runs as HackerOne Code with a focus on secure code review. Unlike AI review tools, the review is done by human experts.

An API generating any number of fake users (name, address, photo). Unlike fixed fixtures it returns varied, realistic data on each call — for form and list tests.

A hosted REST API that answers AJAX requests, with pagination and delay simulation. Unlike JSONPlaceholder it can also emulate response delays and error states.

A test API emulating room booking, with authentication and good docs. Unlike fake APIs it includes writes and auth — a full CRUD flow can be exercised.

A free API serving character, episode and location data over both REST and GraphQL. Unlike single-protocol APIs it exposes the same data two ways, letting you test both.

A sample shopping site with ready logins for learning automation; some users deliberately misbehave. Unlike random demos its scenarios are stable and repeatable.

A browser-based scan that grades a site's HTTP response headers (CSP, HSTS, X-Frame-Options, Permissions-Policy and so on) from A to F and explains what is missing. SSL Labs looks at the TLS layer; this looks at header hardening at the application layer. Instead of the TLS layer, it looks at application-layer header hardening.

A REST API simulating a virtual store, for teaching API testing. Unlike other mock APIs it ships with Swagger docs and can also run locally with npx serverest.

An online practice that builds SQL proficiency with challenging problems. Unlike tutorial sites it is problem-first rather than explanatory; you write the query in the browser and check the result.

A test that scans a site’s TLS configuration and grades it A–F. Unlike the browser padlock it gives detail at the level of certificate chain, protocols and cipher suites.

A compilation of static analysis tools, linters and formatters grouped by language and format (formerly awesome-static-analysis). It is for surveying the options for a language rather than documenting a single tool.

The canonical sample API with a Swagger UI front end — the standard place to learn OpenAPI. Unlike other fake APIs its interface is generated straight from the spec.

A sample REST API filled with Star Wars data. Unlike mutable mock APIs it is a fixed, familiar, read-only dataset — predictable for clients and practice.

Applitools’ free catalogue of test-automation courses by expert instructors, with separate paths for Selenium, Cypress, Playwright and API testing. Unlike scattered video tutorials, it offers ordered learning paths and completion certificates.

An API serving cat images and data — a fun one for prototypes and tests. Unlike fake-data APIs, it has real images plus write endpoints such as votes and favourites; the key is free.

A classic practice site collecting the common scenarios that challenge automation (iframes, file upload, hovering menus) one by one. Unlike demo shops each page teaches a single difficulty.

A site exposing the traps that trip up automation on the modern web (delayed load, hidden elements, dynamic ids). Unlike general demos it targets exactly “why is my test flaky”.

A test measuring a page’s load performance from real devices and locations. Unlike Lighthouse it gives a waterfall, filmstrip and multi-location comparison.