Skip to main content
A test that types test@example.com into a sign-up form works once. Testorim substitutes {{token}} placeholders in a step’s target and value at run time so it works every time.

​
Built-in generators

Always available, nothing to configure.
Each token resolves once per run. The {{random.email}} typed during sign-up is the same address typed during sign-in later in the same run. That is what makes a round-trip test possible.

​
Project variables

Project settings → Variables defines your own tokens, used the same way: {{couponCode}}, {{accountNumber}}. A variable is either a fixed value or a generated one, such as a random integer within a range, for instance. Like the built-ins, each one resolves once per run and keeps that value for every step that references it.
Do not store secrets as variables. Variables are stored as plain project configuration. Real secrets belong in environment headers and cookies, which are encrypted at rest.

​
Values you supply mid-run

Some values cannot exist before the run does: a one-time passcode, an SMS code, a CAPTCHA answer, a device-trust confirmation. Ask for it in the instruction and the run pauses, shows you a prompt, and continues with your answer:
Later steps reference the answer as {{prompt}} (the most recent) or {{prompt:fieldName}} when more than one was requested. The run waits up to 10 minutes.
This needs a person watching. Scheduled runs, CI-triggered runs and fuzz variants have no input channel, so the step fails with that reason rather than hanging.

​
Uploading files

Fixtures are files you attach to a project so a type-into-file-input or upload step has something real to send. Reference the fixture by name in the instruction: “upload the sample-invoice fixture to the attachment field”.

​
Redaction

Values typed into fields whose name suggests a secret (password, secret, token, PIN, OTP, CVV, SSN) are stripped before the run is persisted, before the report model sees them, and before a shared link renders. That covers the typed value, the value read back for verification, both sides of an assertion, and any error or warning text that quoted it. Identifier-shaped names are covered too: userPassword, pwdField and secretKey redact, not just a bare Password.