Exploratory & Ad-hoc Testing
Scripted tests cover what you planned; exploratory testing finds what you did not. Learn the session-based approach, charter-driven testing, and how to document discovery so the insights survive the tester instead of living in someone's head.
What is this?
Exploratory testing is simultaneous learning, test design and execution — the tester designs and runs tests on the fly based on what they observe. It is not unstructured clicking: it uses charters (a mission with scope and a timebox), heuristics and careful note-taking. Ad-hoc testing is the lighter cousin: informal, quick checks without charters. Exploratory testing complements scripted suites by probing real usage, odd data and integration seams that planned cases miss.
Why do you need it?
- The most damaging defects are usually found in paths nobody scripted.
- It explores real user behavior and business workflows, not just spec-conformant happy paths.
- Session-based sessions produce structured results instead of vague 'I clicked around' notes.
- It adapts instantly to new builds, new data or a just-discovered defect, unlike a frozen suite.
- It is the fastest way to cover unanticipated risk areas before a release.
Mental model
A map is not the terrain
A scripted suite is not the app
A hiker follows a map, but a good hiker also reads the actual terrain, finds shortcuts and unexpected hazards the map missed. Exploratory testing is reading the real terrain of the application while the map (scripted tests) covers the planned routes.
How it works
- Define a charter: mission, scope, data and a timebox — for example, 'Explore guest checkout with invalid payment data for 45 minutes'.
- Use heuristics and tours (functional, user, feature, capability) to drive discovery instead of wandering.
- Design and execute tests on the fly, following interesting observations and branching from them.
- Document each finding as you go: what was tested, what happened, evidence, and any defect.
- Debrief the session: share notes, cluster findings and feed the best ones back into the scripted suite.
A session-based exploratory testing loop.
Key commands
echo 'Charter: guest checkout, edge payment data, 45 min' > session.mdRecord the session charter before exploring.
curl -s -X POST https://staging.example.com/api/cart -d '{"qty": 999}' | jq '.status'Probe an edge input the scripted suite never tried.
echo 'qty 999 -> spinner forever, no timeout' >> session.mdDocument the finding with the observation as it happens.
gh issue create --title 'Emoji in city breaks PDF export' --body-file defect.mdPromote a discovery into a tracked defect immediately.
echo 'promoted to scripted: TC-201 edge qty, TC-202 unicode address' >> session.mdFeed the best discoveries back into the scripted suite.
Examples
A charter-driven exploratory session
# Session charterMission : Find data-loss risks in guest checkoutScope : Cart -> checkout -> confirmation, invalid + edge payment dataData : empty cart, huge quantities, discount codes, emoji in addressTimebox : 45 minutesTester : QAResult : 2 defects found (quantity 999 freezes cart, emoji in city breaks PDF) # Session notes- Started on empty cart: "checkout" navigates to login unexpectedly- Quantity 999: spinner spins forever, no timeout error- Emoji in city: PDF export renders raw bytes, 500 on download- Evidence: screencast session-3.mov + HAR per defectThe charter gives the session a mission, scope and timebox; the notes capture what was tried and what happened with evidence. Two real defects surfaced because the exploration pushed past the scripted happy path.
In production
- Release-bound sessions run charters against the riskiest flows in addition to the full regression.
- After any major refactor, exploratory passes find integration breaks faster than waiting for the suite.
- New testers gain product knowledge fast by running charters with a senior tester reviewing the debrief.
- Defects found in exploratory sessions feed regression cases, so discovery compounds over time.
Best practices
- Always write a charter with a mission, scope and timebox before exploring.
- Use tours and heuristics (inputs, boundaries, states, integrations) to stay systematic.
- Document as you go — notes taken after the session lose detail.
- Debrief every session and feed discoveries back into the scripted suite.
- Run exploratory sessions on the latest build against realistic data, not demo data.
Common mistakes
- Treating exploratory testing as unstructured clicking without a charter.
- Forgetting to document, so findings evaporate with the tester.
- Exploring only happy paths and never hostile or edge inputs.
- Keeping exploratory sessions secret from the scripted test effort instead of feeding them back.
Common issues
Sessions produce nothing actionableNo charter, so exploration drifts
Scope each session with a mission, a data list and a timebox.
Findings are lost after the sessionNo notes taken during exploration
Document as you go and debrief at the end of every session.
Manager sees exploratory testing as 'random clicking'No reporting structure
Use charters, session notes and defect counts so the value is visible.
Debugging tips
- When something looks odd, change one variable at a time to isolate what triggers it.
- Follow error messages into adjacent flows — a broken endpoint often breaks its callers too.
- Revisit the same area with different data (fresh, empty, huge, unicode) to widen the search.
- Log the build and environment for every session so findings are reproducible.
Interview checkpoint
Hands-on lab
- Write an effective session charter
- Use heuristics and tours to drive discovery
- Document findings with evidence as they occur
- Debrief and feed discoveries back into the scripted suite
Run a Charter-Based Exploratory Session
45 min · intermediate
Quick quiz
What is the key differentiator of exploratory testing?
A charter makes exploratory testing structured and documented.
Your exploratory session finds an unusual but real failure. What should you do?
Cheat sheet
MissionWhat to find, in one lineScopeFlows and features to probeDataEdges: empty, huge, unicode, invalidTimeboxe.g. 45 minutesNotes + evidenceDocument as you go