Almost every app you have ever cursed at — the bank app that spun forever, the checkout that charged you twice, the form that swallowed your details and said nothing — reached you because somebody did not test it properly. That job, finding the broken thing before a real customer does, is called software testing, and it is one of the very few tech roles you can start with no degree, no coding background, and nothing but a laptop, a browser and a stubborn mind.
This is a complete free course. Not a teaser, not a list of links. Five days, five sittings of about 90 minutes each, and at the end of it you will have written real test cases, hunted down a bug that was deliberately hidden from you, filed a bug report a developer could actually act on, and built the first piece of a portfolio you can show a client. You will also do something most testing courses have not caught up to yet: you will use AI as your practice partner, your sparring opponent and your bug factory — while learning exactly where it helps and where it quietly lies to you.
Everything below is designed to be done, not read. Read a section, then do the thing in the box. Testing is not a subject you understand. It is a reflex you build.

- Five days, one sitting each. About 90 minutes. Doing two in a day is allowed; skipping the practicals is not.
- Everything is free and browser-based. You need Chrome (or Edge, or Firefox), an internet connection, and somewhere to write — Google Docs, Word, a notebook, anything.
- Every day has an AI Drill. Use ChatGPT, Claude, Gemini or any free chatbot. Prompts are written out for you to copy.
- Every day ends with a quiz you mark yourself. Answer first, then click to reveal. Lying to yourself here only costs you.
- Day 5 produces a portfolio piece. That document is the thing you send to a client, not this certificate-free article.
The 5-Day Map
| Day | What you learn | What you walk away with |
|---|---|---|
| Day 1 | How websites, apps, servers and databases actually work | You can open DevTools and read what a page is doing |
| Day 2 | The tester's mindset and edge-case thinking | 10 written test cases on a real live form |
| Day 3 | Functional testing, status codes, the hidden bug hunt | A buggy practice app you built with AI — and beat |
| Day 4 | The contexts nobody checks, and bug reports that get taken seriously | One professional bug report, reviewed by AI |
| Day 5 | Test plans, the capstone hunt, and getting paid | A portfolio document and a list of places to apply |
One warning before Day 1. There is a version of this course you can do in ninety minutes total, by reading all five days and doing none of the exercises. That version teaches you the vocabulary of testing, which is exactly enough to fail an interview confidently. The gap between someone who knows about testing and someone who gets hired to test is entirely in the practicals. Do them.
Wait — How Does This Thing Even Work?
You cannot test what you cannot see. Today you stop being a user of the internet and start being someone who can look inside it.
- Explain the difference between a website, a web app and a mobile app in your own words
- Describe the client–server relationship without sounding like a textbook
- Open DevTools on any page and read the Elements, Console and Network tabs
- Trace, step by step, everything that happens when someone clicks "Login"
1. Website, web app, mobile app — and why the difference matters to you
A website is something you mostly read. A blog, a news site, a company's About page. You click, you scroll, you leave. You change almost nothing.
A web app also lives in a browser, but it does things for you. You log in, you submit data, the page changes based on what you did. Gmail is a web app. So is Instagram on your laptop. So is any food-ordering platform. The difference is not the technology — it is how much you can change inside it.
A mobile app is installed on the phone itself, from the Play Store or App Store, and it can reach things a browser usually cannot: your camera, your GPS, your contacts, push notifications.
Why a tester cares: different kinds of software break in different places. A web app breaks when you press the browser's Back button after paying. A mobile app breaks when you rotate the phone mid-form, or when NIN verification runs and your network drops. Knowing what you are holding tells you where to go looking for trouble.
2. The restaurant: client, server, frontend, backend
Every app is a conversation between two computers: your device and a computer somewhere else. The clearest way to hold this is a restaurant.
You sit at a table and tell the waiter what you want. The waiter carries your order to the kitchen. The kitchen cooks it. The waiter brings the food back. You never enter the kitchen — you only experience ordering, waiting, and receiving.
| In the restaurant | In software | What it means |
|---|---|---|
| You at the table | The client | Your browser or phone screen — what you see and tap |
| The menu and the table | Frontend | Everything visible: layout, buttons, colours, forms |
| The waiter | The API | The messenger carrying requests there and answers back |
| The kitchen | The server / backend | Where the real logic happens, out of your sight |
| The store room | The database | Organised permanent storage — a very smart searchable spreadsheet |
That is the whole architecture of nearly everything you will ever test. When a tester says "I think it's a backend issue", they are saying: the waiter delivered my order fine, but the kitchen sent back the wrong plate.
3. What really happens when you click "Login"
This is the single most useful mental model in this entire course. Read it slowly. Almost every bug you will find in your career lives somewhere in these seven steps.
- You type your email and password. (Frontend — HTML built the form, CSS styled it, JavaScript is watching for your click.)
- You click Login. JavaScript grabs what you typed and packages it into a request.
- That request travels over the internet to the backend. (API.)
- The backend receives it and asks the database: does a user with this email exist, and does the password match?
- The database answers: match, or no match. (Your password is not stored as readable text — it is stored scrambled, so that even the company cannot read it.)
- The backend sends a response back through the API: success with a login token, or failure with an error message.
- The frontend receives that response and either shows your dashboard, or shows "Incorrect email or password."
Now look at how many places that can go wrong. The frontend might send the email with a trailing space. The backend might compare passwords case-sensitively when it shouldn't. The database might be slow and the frontend might give up waiting. The response might be correct but the frontend might display nothing at all — so the user clicks Login six more times. You do not need to write the code. You need to know where to point.

4. Meet DevTools — your new best friend
Every browser has a hidden panel called Developer Tools. Right-click anywhere on a page and choose Inspect, or press F12 on Windows, or Cmd + Option + I on Mac. Three tabs matter today:
- Elements — the actual structure of the page. Hover over lines here and the matching part of the page lights up. You can even edit text temporarily, which is how people make those fake screenshots.
- Console — messages and errors the page is producing in the background. Red text here almost always means something broke.
- Network — every single request the page makes to the server, and whether each one succeeded or failed. Refresh a page with this open and watch the whole conversation happen.
Here is the thing that should genuinely excite you: a page can look completely normal to every user on earth while the Console is full of red errors and the Network tab shows requests failing. Those failures are real bugs. Most people will never see them. You now can.
5. The names you will keep hearing
You are not going to write code in this course. But you will sit in meetings where these words fly around, and looking blank costs you credibility. Here is roughly what each one is for.
| Layer | Names you'll hear | What it does |
|---|---|---|
| Frontend | HTML, CSS, JavaScript | HTML builds the structure, CSS makes it look good, JavaScript makes it react |
| Backend | Python, PHP, Node.js, Java | Different companies pick different ones; they all hold the logic and talk to the database |
| Database | MySQL, PostgreSQL, MongoDB | MySQL and PostgreSQL store neat tables; MongoDB stores flexible, list-like records |
| Mobile | Swift, Kotlin, Flutter, React Native | Swift is iPhone only, Kotlin is Android only, Flutter and React Native do both at once |
Make AI read the error you cannot read yet
Console errors are written by developers, for developers. Today you use AI purely as a translator — not to think for you, but to turn one line of jargon into one line of English so you can decide whether it matters.
Copy this prompt into ChatGPT, Claude or Gemini:
I am learning software testing. I found this error in my browser's
Console tab on a live website. Explain it to me in plain English:
1. What does this error actually mean?
2. Is this a frontend problem or a backend problem?
3. Would a normal user notice anything, or is it invisible to them?
4. On a scale of "cosmetic" to "serious", how bad is it and why?
Do not give me code fixes. I am the tester, not the developer.
ERROR: [paste the red text from your Console here]
The catch — read this part. AI will sound completely confident even when it is guessing, because it cannot see the website. It does not know your context. Treat its answer as a colleague's opinion shouted across the room, not as fact. Your job is to check it against what you can see with your own eyes in the Network tab. That habit — trust, then verify — is the single most valuable thing you can carry out of this course.
- Open three different sites: one plain website (a blog or news site), one interactive web app (Gmail, an online store, your bank's web portal), and one of your own choosing.
- On each one, open DevTools and visit all three tabs: Elements, Console, Network.
- Write down: did you see any red errors in the Console? On which site, and what did it say?
- Refresh with the Network tab open. Write down the last request that loaded, and how many requests the page made in total.
- Screenshot one Console tab — error or clean — and save it in a folder called
testing-course. You are starting your evidence habit today.
Reflect in two lines: which of your three sites felt most like a "web app" and why? And what surprised you most about what was happening underneath?
Q1. What is the real difference between a website and a web app?
Reveal the answer
A web app is interactive — you log in, submit data, and change things inside it. A website is mostly for reading and browsing. It is about how much the software does for you, not about the technology used.
Q2. In the restaurant analogy, what does the waiter represent?
Reveal the answer
The API — the messenger that carries the request from the frontend to the backend and carries the answer back.
Q3. Which DevTools tab shows you a red error caused by broken code?
Reveal the answer
The Console tab. (Network shows failed requests; Elements shows page structure.)
Q4. In your own words: what is a database, and why does an app need one?
Reveal a good answer
A database is organised, permanent storage — like a very smart, searchable spreadsheet living on the server. Apps need one so they remember things between visits: your account, your orders, your messages. Without it, the app forgets everything the moment you close it.
Tick before you move on:
Start Thinking Like Someone Who Breaks Things
Day 1 gave you vocabulary. Today gives you the actual skill. Everything after this is just this mindset with better tools.
- Describe what a tester does all day, and the four ways testers get paid
- Define an edge case and produce your own examples on demand
- Write a properly formatted test case that anyone could repeat
- Produce 10 real test cases for a live form, with no coding at all
1. What a tester actually does all day
A tester uses software the way a real person would — and also the way a careless, rushed, confused, dishonest or very unlucky person would — before real customers get the chance. Then they write down three things: what they did, what they expected, and what actually happened. When the last two do not match, that is a bug.
A normal working day is usually some mix of three activities:
- Regression testing — running through a checklist of existing features after an update, confirming nothing that used to work has quietly stopped working.
- Exploratory testing — poking at a brand-new feature with no checklist at all, just to see what happens.
- Focused breaking — taking one feature and deliberately trying to destroy it.
2. How testers actually earn
| Route | What it looks like |
|---|---|
| In-house QA | You join a company's product team full-time or on contract as their quality gate. Junior QA roles very rarely require a degree. |
| Agency work | An agency tests client projects before launch. You test something different every few weeks. |
| Freelance gigs | Businesses post short-term QA jobs on Upwork and Fiverr — "test my app before Friday." |
| Bug bounties | HackerOne and Bugcrowd let companies publicly pay anyone who finds real bugs, often security ones. Some people earn a full income this way. |
3. The one question that separates a sharp tester from everybody else
"What happens if I do this wrong, weird, or too much?"
A normal user does the expected thing, once, carefully. A tester does the unexpected thing — repeatedly, incorrectly, at the wrong time, in the wrong order, on purpose. That is the entire job description, and it is a habit you can build in a week.

4. Edge cases — the seven categories
An edge case is an unusual, extreme or unexpected situation sitting right at the edge of what the software was built to handle. Software is nearly always built and checked for the normal path. Your value as a tester lives entirely outside that path.
| Category | What to try | Real example |
|---|---|---|
| Boundary values | The smallest, largest and exact-limit values a field allows | An age field accepting 0–120: try 0, 120, then -1 and 121 |
| Empty input | Leave a required field blank and submit anyway | Does it say what is missing, or fail silently? |
| Wrong data type | Letters in a number field, emojis in a name field | Type "banana" as your age. Then 😀 as your surname. |
| Rapid repeated actions | Click Submit or Buy many times, fast | Does it charge one customer three times? |
| Network failure | Kill the connection mid-action | Turn off data during checkout. Where did the money go? |
| Concurrency | Two things happening at the same instant | Two people buying the last item in stock in the same second |
| Special / very long input | Symbols like < > ' " and 10,000-character pastes | Paste a full chapter of a book into a "Full name" field |
Sit with a few of these, because they are not hypothetical. "Clicking Buy 100 times fast" is how people discover that a payment endpoint has no protection against repeat submissions — a bug that costs real customers real money. "Losing internet mid-checkout" is the single most common real-world condition on the African internet and the single least tested one. And "two people buying the last item at once" is how an online store ends up selling stock it does not have and having to refund and apologise.
5. Writing a test case that another human can actually follow
A test case is a documented, repeatable check. Five parts, always:
| Field | Meaning |
|---|---|
| Test Case ID | A short label like TC-01, so it can be referenced in a meeting |
| Steps | The exact actions in order, so anyone could repeat them |
| Expected Result | What should happen if the software is working correctly |
| Actual Result | What genuinely happened when you ran it |
| Status | Pass if expected matches actual. Fail if it does not. |
TC-01
Steps: On the signup form, leave the Email field empty and click Submit.
Expected Result: Form does not submit; an error message appears under the Email field.
Actual Result: Form submitted successfully with no email saved.
Status: FAIL
Beat the machine at edge cases — then beat it again
Here is how to use AI without letting it do your thinking. Write your own list first. Only then ask the machine, and see what you missed. Do it in this order or the exercise is worthless.
Step 1 — before you open any AI tool, spend ten minutes writing every way you can think of to break a signup form. Aim for fifteen.
Step 2 — now paste this:
Act as a senior QA engineer reviewing a junior tester's work.
Here is a signup form with these fields: Full Name, Email,
Phone Number, Password, Date of Birth.
Here is MY list of edge cases:
[paste your 15 here]
Now:
1. Which of my cases are genuinely strong? Say why.
2. Which are weak or duplicated? Say why.
3. What are 8 edge cases I missed that a real user could
realistically hit — especially around network failure,
concurrency and very long or special-character input?
4. For each one you add, tell me what could go wrong in the
database or the backend if it is not handled.
Be blunt. Do not flatter me.
Step 3 — the part that matters. Take the eight it gave you and go actually try them on a real form. You will find that some of the AI's suggestions are impossible to perform, some are irrelevant to that form, and one or two are excellent. That ratio is the lesson. AI is a very fast, very confident brainstorming partner with no eyes. You are the one who can see the screen.
- Pick any real signup or login form you can legally use — your own account on a site, or a public demo store.
- Write 10 test cases in the 5-part format, covering at least four different edge-case categories from the table above.
- Actually run at least five of them and record what truly happened — not what you assume happened.
- Mark each Pass or Fail honestly. A test case you wrote but did not run is a lie with formatting.
Reflect: which of your ten do you think the developers never considered? Did any of your five actually reveal strange behaviour?
Q1. A user types "banana" into an age field. Which edge-case category is that?
Reveal the answer
Wrong data type — text where a number is expected.
Q2. Two customers buy the last item in stock in the same second. What is that called?
Reveal the answer
A concurrency edge case. If handled badly, the shop oversells stock it does not have.
Q3. What goes in the "Expected Result" field of a test case?
Reveal the answer
What should happen if the software is working correctly — written before or independent of what actually happened.
Q4. Write one full test case, all five parts, for a checkout "Apply Coupon Code" field.
Reveal a model answer
TC-07 · Steps: Add an item to cart, go to checkout, enter an expired coupon code "XMAS2019", click Apply. · Expected: Coupon is rejected with a clear message such as "This code has expired"; order total is unchanged. · Actual: Discount applied and total reduced by 20%. · Status: FAIL. Full marks for structure; bonus marks because you tested an edge case rather than the happy path.
Hands on the Keyboard, Bugs on the Table
Today you stop learning about testing and start doing it — including the exercise that teaches the hardest lesson in this course: testing something once proves nothing.
- Run a functional sweep across buttons, forms, links and navigation
- Read HTTP status codes in the Network tab and know which ones are your problem
- Spot a silent failure — a page that looks perfect and is quietly broken
- Find a bug that was deliberately hidden from you
1. Functional testing, plainly
Functional testing asks one question of every single thing on a screen: does this do what it says it does? Does the button go where it claims? Does the search bar actually search? Does "Forgot Password" lead anywhere useful, or to a dead page? It is the most basic layer of testing and it is where essentially every testing job starts.
The method is boring and that is the point. You go left to right, top to bottom, and you touch everything. Testers who "have a feel for where bugs are" got that feel by first being systematic a few hundred times.
2. Status codes — the numbers that tell you the truth
Every request your browser sends comes back with a three-digit status code. You will see these for the rest of your career:
| Code | Means | What you do about it |
|---|---|---|
| 200 | OK / Success | Nothing. It worked. |
| 404 | Not Found | The page or file requested does not exist. Usually a broken link or a missing image. Report it. |
| 500 | Internal Server Error | Something broke on the backend. This is a real bug and it is worth reporting immediately. |
| 401 / 403 | Unauthorized / Forbidden | The user is not allowed here. Ask yourself whether that is actually correct — sometimes it is the bug. |
The move that makes you valuable: keep the Network tab open while you browse normally. When a page looks completely fine but you can see a 500 or a 404 quietly failing behind it, you have just found something no ordinary user would ever have reported. This is the difference between "I clicked around" and "I tested it".
3. The hidden bug — and why one click proves nothing
Real bugs are rarely waiting politely on the surface. The dangerous ones hide behind conditions:
- A Buy button that works perfectly the first 98 times and throws an error on the 99th.
- A form that accepts everything correctly except a name of exactly one character.
- A page that is flawless until the browser is narrower than a certain width, at which point a button slides behind another element and becomes unclickable.
- A feature that only fails when the connection is slow enough for two requests to overlap.
Nobody hands a tester a list of bugs to go confirm. You are handed a product and told: something in here is wrong. Find it. Today you are going to build exactly that situation for yourself — and you are going to build it with AI, which is the most useful thing AI does for a learning tester.
Make AI build you a broken app — then refuse to read the code
Every testing course has the same problem: to practise finding hidden bugs, somebody has to hide them for you. AI solves that permanently. From today you can generate an unlimited supply of practice targets, at any difficulty, in about thirty seconds — which is something testers five years ago simply could not do.
Paste this prompt exactly:
Build me a single-file HTML page (HTML, CSS and JavaScript all
in one file, no libraries, no internet needed) that works as a
small fake online shop called "PracticeMart".
It must have: a product list with 4 items, an "Add to cart"
button on each, a cart counter in the header, a quantity field,
a coupon code box, and a checkout form asking for full name,
email, phone number and delivery address.
Now plant exactly 4 BUGS in it, of these 4 different kinds:
1. One functional bug (something visibly does the wrong thing)
2. One edge-case bug that only appears after a repeated action
or at an exact boundary value
3. One responsive bug that only appears below 500px width
4. One silent bug that logs an error to the browser Console but
looks completely fine on screen
Rules:
- The page must look totally normal on a casual click-through.
- Do NOT tell me what the bugs are.
- Do NOT put comments in the code describing them.
- At the very end, output the answer key inside a code block
labelled ANSWER KEY that I will not scroll to until I am done.
Give me the full file, ready to save as practicemart.html.
Now the discipline part. Save the file as practicemart.html, double-click it to open it in your browser, and do not read the source code. Reading the code is cheating and it teaches you nothing, because on a real job you will never have the code, the developer's notes, or an answer key. Hunt it like a black box: click everything, click things too many times, resize the window, empty every field, paste rubbish into every input, keep the Console open the whole time.
Only when you are certain you are done, scroll to the answer key and see how many of the four you caught. Most people get two on their first attempt. If you got three, you have a real aptitude for this. If you got four, generate a harder one with six bugs and do it again.
Hunt A — your generated app (30 min). Run the AI drill above. Write down every bug you find, in the order you found it, and note how you found it. Then check the answer key and write one honest line: what was your method — random clicking, or a system? The people who find the fourth bug almost always had a system.
Hunt B — a real live site (30 min). Pick a real website you did not build. Click through every visible button, link and form for half an hour with the Network tab open the entire time. Log at least three things that behaved unexpectedly — even small ones: a broken link, a form with no confirmation message, an image that never loads, a 404 firing in the background. Note which was easier to spot: the visible bug, or the silent one. That answer is the reason testers get paid.
Q1. What does a 500 status code usually mean?
Reveal the answer
Something broke on the backend or server side. Report it immediately — it is a genuine defect, not a user mistake.
Q2. A page looks perfect but the Console shows a red error and the Network tab shows a failed request. Is that a bug?
Reveal the answer
Yes — a silent failure. Something the page tried to do did not happen. It may be invisible today and cause missing data or a broken feature tomorrow. Report it with the exact error text and the failing request.
Q3. Why is clicking a button once and seeing it work not enough?
Reveal the answer
Because a large share of expensive bugs are conditional — they only appear on the Nth repeat, at an exact boundary, at a certain screen width, or when the network is slow. Testing something once only proves it can work, not that it does work.
The Contexts Nobody Checks — And Reports Nobody Ignores
Finding a bug is half the job. Getting it fixed is the other half, and that half is writing.
- Test any page in mobile view, on a throttled connection, and with the keyboard alone
- Judge severity honestly instead of calling everything urgent
- Write a bug report a developer can act on without asking you a single question
1. Three contexts almost nobody tests
Mobile and responsive view. Most sites are designed for a big desktop screen first and squeezed down afterwards, and the squeezing is where things break. In DevTools, click the small phone/tablet icon (Toggle Device Toolbar) and preview the page at phone width. Look for overlapping text, buttons pushed off-screen, menus that will not open, and forms you cannot submit because the button is under the keyboard.
Slow network. In the Network tab there is a dropdown that usually says "No throttling". Change it to Slow 3G. Now reload. This is not an edge case in Nigeria, Ghana or Kenya — it is Tuesday. The question you are answering is: does the app show a loading indicator that tells the user to wait, or does it just sit there looking frozen and broken until the user gives up, closes it, and tells their friends the app does not work?
Keyboard only. Put the mouse down. Navigate the page using only Tab, Shift+Tab, Enter and the arrow keys. Can you reach every field and button? Can you always tell which element is currently selected? Some users navigate this way permanently, including people with motor impairments and people using screen readers. When keyboard navigation is broken, those users simply cannot use the product at all — and that is both an accessibility failure and, increasingly, a legal one.

2. Why most bug reports get ignored
A bug report is only useful if a developer can read it once and immediately understand what went wrong and how to see it themselves. A vague report — "the buy button is broken, please fix" — goes to the bottom of the pile, because reproducing it will cost the developer thirty minutes of guessing. A precise report gets fixed the same day, and gets you hired again.
3. The eight parts of a report that gets fixed
- Title — short, specific, searchable. Not "button doesn't work" but "Buy button throws 500 error on the 99th consecutive click".
- Environment — browser and version, operating system, device, the exact URL, the date and time.
- Steps to reproduce — numbered, exact, repeatable. Anyone following these should see the same thing.
- Expected result — what should have happened.
- Actual result — what really happened, precisely.
- Severity / priority — how bad is it, honestly.
- Evidence — screenshot, screen recording, or the Console log. A picture ends all argument.
- Frequency / notes — every time, or sometimes? Anything else you noticed nearby?
4. Severity, judged honestly
| Severity | Meaning | Example |
|---|---|---|
| Critical | Crash, data loss, or money affected | A customer is charged twice for one order |
| High | A major feature broken with no workaround | Nobody can complete checkout at all |
| Medium | Broken, but there is a way around it | Filters do not work, but search still finds the item |
| Low | Cosmetic or rarely encountered | A button is slightly misaligned at one screen size |
A junior tester marks everything High because everything feels urgent when you just found it. A tester people trust marks the misaligned button Low — and precisely because they do, everyone believes them when they mark something Critical.
5. Bad report versus good report
| ✗ Ignored | ✓ Fixed today |
|---|---|
| "The buy button is broken. Please fix." |
Title: Buy button throws 500 error on the 99th consecutive click Environment: Chrome 128, Windows 11, /product/123, 26 Aug 2026, 2:14pm Steps: 1) Open the product page 2) Click Buy 99 times in a row 3) Observe the 99th click Expected: Item added to cart, or the repeated click is ignored Actual: Page shows "500 Internal Server Error" and the cart is emptied Severity: High — cart data is lost Evidence: Screenshot + Console log attached Frequency: Every time, reproduced 3 times |
Let AI be the annoyed developer who received your report
This is the highest-value use of AI in this entire course, because it fixes the one thing beginners cannot see about their own writing: the gap between what is in their head and what is on the page.
Write your bug report first. All eight parts. Then paste this:
You are a busy senior developer. A tester just sent you the bug
report below. You have never seen this product and you cannot
ask any questions.
Read it and answer strictly:
1. Following ONLY these steps, could you reproduce this bug?
Where exactly would you get stuck or have to guess?
2. List every piece of information that is missing or vague.
3. Is the severity justified by the described impact, or is it
over-stated? Say what you would change it to and why.
4. Rewrite the title so it is specific and searchable.
5. Score the report out of 10 for reproducibility, and tell me
the single change that would raise the score the most.
Be strict. A generous review helps me nothing.
BUG REPORT:
[paste yours here]
Then rewrite your report and run it through again. Two rounds of this will do more for your report-writing than a month of reading examples. But do not let AI write the report for you — it does not know what you saw, so it will invent plausible details, and a bug report containing one invented detail is worse than no report at all. AI reviews; you write.
- Take one website — your PracticeMart file or a real site — and test it under all three conditions: mobile view, Slow 3G throttling, and keyboard only.
- Log at least one thing per condition that broke, looked wrong, or was harder than it should be. Note which condition revealed the most.
- Pick your best find and write a complete bug report — all eight parts, with a screenshot attached and a one-sentence justification of the severity you chose.
- Run it through AI Drill 04. Rewrite it. Keep the final version — it goes in your portfolio.
The real test: hand your report to someone who has never seen the bug — a friend, a sibling, anyone — and ask them to follow the steps. If they cannot see the bug, your report is not finished, no matter how good it looks.
Q1. Which part of a bug report lets a developer see the bug themselves?
Reveal the answer
Steps to reproduce — numbered, exact and repeatable.
Q2. A bug charges a customer twice for one order. What severity?
Reveal the answer
Critical. Money is directly affected, and so is trust.
Q3. Name the eight parts of a great bug report.
Reveal the answer
Title, Environment, Steps to Reproduce, Expected Result, Actual Result, Severity/Priority, Evidence, Frequency/Notes.
Q4. Why does keyboard-only testing matter if you personally use a mouse?
Reveal the answer
Because plenty of users do not use a mouse — including people with motor impairments and screen-reader users. If keyboard navigation is broken, those people cannot use the product at all, and that ships to production unnoticed unless a tester checks it.
Test Plan, Capstone, and Getting Paid
Today you do the work the way a real QA sprint is done — under a clock — and you leave with a document you can send to a stranger.
- Write a test plan for a real feature and defend your priorities
- Run a timed bug hunt and score yourself against a professional rubric
- Produce a portfolio document and know exactly where to send it
1. What a test plan is, and why it exists
A test plan is a structured list of everything that must be checked before a feature ships — organised so nothing important is forgotten, and written clearly enough that a tester who has never seen the project can pick it up and know what to do. It is the difference between "I tested the checkout" and being able to say precisely what you tested, what you did not, and why.
2. Risk-based prioritisation — because you will never have enough time
You will almost never be given time to test everything equally. So you spend your hours where failure is most likely and most expensive. The question is always the same: if this breaks, how many people are affected and how badly?
A payment step affects every customer and costs money directly — test it hardest, test it repeatedly, test it on a bad connection. A typo in a footer link affects almost nobody — test it last, if at all. Testers who cannot prioritise spend three days on the footer and ship a broken checkout.
3. What goes into the plan
- Feature name and scope — exactly what is being tested, e.g. "Checkout — Apply Coupon Code".
- Priority list — the areas inside that feature, sorted Critical / High / Medium / Low, each with one line of reasoning.
- Test cases — the actual list, in the five-part format from Day 2.
- Out of scope — what you deliberately are not testing this round, and why. This part protects you. When something you never agreed to test breaks, the plan is the receipt.
- Choose the checkout flow of any online store you know.
- List 3 Critical, 3 High and 2 Medium/Low items to test, each with a one-line reason for its priority.
- Write 8 full test cases covering those priorities, in the five-part format.
- Name one thing you are deliberately leaving out of scope, and explain why in one sentence.
Ask yourself: which single item on your Critical list would do the most damage to the business if it broke? If your answer is not obviously the most expensive failure, re-sort your list.
4. The capstone: a timed hunt, exactly like a paid sprint
This is the piece that becomes your portfolio. Generate a harder practice target, set a timer, and work like you are being paid for the hour — because on your first gig, you will be.
Generate the exam, sit it, then have it marked
Step 1 — build the capstone app:
Build me a single-file HTML page (no libraries, works offline)
for a fake service called "SwiftPay" — a simple money transfer
app with: a login form, a balance display, a "Send money" form
(recipient account number, amount, narration), a transaction
history list, and a settings page with a profile form.
Plant exactly 5 BUGS across these categories:
- one functional bug
- one edge-case bug tied to a boundary value or repeated action
- one responsive/UI bug that only appears on a narrow screen
- one that only shows itself when an input is empty or unusual
- one silent bug that only appears in the Console
Make it harder than a beginner exercise: none of the bugs should
be visible on a casual click-through. Do not describe the bugs.
No revealing comments in the code. Put the ANSWER KEY in a
separate code block at the very end.
Step 2 — set a timer for 45 minutes and hunt. No reading the code, no peeking at the key. Write full eight-part bug reports as you go, not afterwards — writing while hunting is the real skill, and it is what the clock is for.
Step 3 — mark yourself against the rubric below, honestly. Then paste your reports back to the AI with this:
Here is the answer key you produced, and here are the bug
reports I wrote during a 45-minute timed hunt.
Score me out of 100 using this rubric:
- Bugs found (40): how many of the planted bugs I correctly identified
- Report quality (30): are all 8 parts present, clear and specific
- Severity accuracy (15): does my severity match the real impact
- Reproducibility (15): could another tester follow my steps exactly
For each planted bug I missed, tell me what I would have had to
do differently to find it. Be specific about the technique, not
encouraging about my effort.
| Criteria | Points | What is being judged |
|---|---|---|
| Bugs found | 40 | How many of the planted bugs you correctly identified |
| Report quality | 30 | All eight parts present, clear and specific |
| Severity accuracy | 15 | Severity assigned matches the real impact |
| Reproducibility | 15 | Could another tester follow your steps and see the same bug? |
Score under 50 on your first attempt? That is normal, and it is information, not a verdict. Generate a fresh app and go again. The second run is always dramatically better than the first, and that jump is the thing you should notice about yourself.

5. Where this turns into money
| Where to look | What to expect |
|---|---|
| Upwork, Fiverr | Short QA gigs — "test my app before launch". Small first, but a completed job with a good review is worth more than a certificate. |
| HackerOne, Bugcrowd | Public bug bounty programmes. Harder and more security-focused, but they pay for results, and nobody asks about your degree. |
| Junior QA roles | In-house and agency positions. These rarely require a degree — they require evidence that you can find and describe bugs. |
| Your own network | Someone you know has a website with broken things on it. Test it free, send a clean report, ask for a referral. This is how a surprising number of QA careers actually start. |
- Compile your capstone bug reports into one clean document — Google Docs is fine, PDF is better.
- Add a one-paragraph summary at the top: what you tested, how long you spent, how many bugs you found and their severity spread.
- Add your screenshots. Every report gets its evidence.
- Add one honest closing line about what you would test next if you had more time. Clients notice that line more than anything else in the document.
- Name it properly —
QA-Report-SwiftPay-YourName.pdf— and keep it. This is the first item in your testing portfolio.
Q1. What does risk-based prioritisation actually mean?
Reveal the answer
Spending most of your testing time on whatever is most likely to break, or most expensive if it does — judged by how many users are affected and how badly.
Q2. Which of these belongs at the top of a test plan's Critical list?
Reveal the answer
The payment step that could charge customers incorrectly. Not the misaligned footer icon, not the tooltip that appears half a second late.
Q3. In the capstone rubric, what is "reproducibility" measuring?
Reveal the answer
Whether another tester could follow your steps exactly and see the same bug — not how many bugs you found, and not how many screenshots you attached.
Q4. Name two realistic ways a tester earns money, and one difference between manual and automation testing.
Reveal a good answer
Any two of: in-house QA role, agency work, freelance gigs on Upwork or Fiverr, bug bounty platforms like HackerOne or Bugcrowd. And: manual testing is a human performing and judging the tests directly; automation testing uses scripts and tools to repeat those same tests without a person running them each time.
The honest section: where AI helps you, and where it will lie to you
You have now used AI five different ways in five days. It is worth being precise about what actually happened there, because "use AI" is advice that gets people into trouble.
| AI is genuinely excellent at | AI will quietly fail you at |
|---|---|
| Generating unlimited practice apps with planted bugs | Knowing whether something is actually broken — it cannot see the screen |
| Translating an error message into plain English | Judging severity, which depends on the business, not the code |
| Reviewing your report as a hostile reader | Writing the report — it will invent details it did not witness |
| Expanding a list of edge cases you already started | Producing the first list, which is where your judgment lives |
| Explaining an unfamiliar term instantly, without embarrassment | Telling you it does not know. It will guess, confidently, in the same tone as the truth. |
The pattern is consistent: AI is superb at producing raw material and pressure-testing your work, and unreliable at observing reality and making judgment calls. Testing is a job made almost entirely of observing reality and making judgment calls. That is exactly why testers are not the ones AI replaces — but a tester who uses AI well practises five times faster than one who does not. Be that one.

What "finished" actually looks like
If you did the work rather than the reading, you can now do all of this without help. Tick honestly — the unticked ones are your next week.
What to learn next
This course deliberately covered manual testing — the thinking skill everything else is built on. Neither of these next steps is required to start earning, but both raise your rate:
- Automation testing with Selenium or Playwright — writing scripts that run your same tests over and over without you. The people who write good automated tests are the people who first learned to test by hand; automation only repeats the thinking you already did.
- API testing with Postman — checking the backend directly, without going through the frontend at all. Remember the waiter and the kitchen? This is walking into the kitchen.
If you want structure and people around you while you build the coding side of this, our frontend development course and data analyst course both start from zero the same way this one did. You can see everything currently open on the courses page.
Frequently asked questions
Do I need to know how to code to become a software tester?
No. Manual testing — the whole of this course — requires no coding at all. You need to understand how the pieces fit together, which is what Day 1 was for. Coding becomes useful later, when you move into automation, and by then you will have a reason to learn it.
Can I really learn software testing in 5 days?
You can learn the foundations and produce your first real work in five days — that is exactly what this course does. You will not be a senior QA engineer. You will be someone who can find bugs, write reports professionals respect, and honestly show a client what they can do. That is a genuine starting point, and it is more than most people applying alongside you will have.
Do I need a degree or a certificate to get a QA job?
Junior QA roles very rarely require a degree. What they require is evidence. A folder of clean, specific bug reports on real or simulated products does more for you in an interview than any certificate, because it answers the only question the interviewer actually has: can this person find things?
What tools do I need to start?
A laptop, a browser with DevTools (Chrome, Edge or Firefox — all free), somewhere to write, and a free AI chatbot for the drills. That is the entire toolkit for everything in these five days.
Will AI take software testing jobs?
AI is very good at generating tests and terrible at deciding what matters, and testing is mostly deciding what matters. What is genuinely changing is speed: a tester who uses AI to generate practice targets, review their writing and expand their thinking works far faster than one who does not. Learn it as a tool, not as a replacement for your own eyes.
You finished. Now go break something on purpose.
You have the mindset, the tools and a portfolio document. The next step is repetition — a new practice app, a new hunt, a new report, every week until it is a reflex. And if you want to build the technical side properly, with tutors and a cohort rather than alone, that is what Webbo3 Academy is for.
See what's open at Webbo3 →Written by the instructors at Webbo3 Academy. Share this with the person who keeps saying they want to get into tech but does not know where to start — five days and a browser is genuinely all this one takes.


