Access Control Scenario Generator
Testing every combination of authentication state, role, resource state, request origin and rate limit means hundreds of cases. Testing pairs — every two values appearing together at least once — catches most interaction bugs in a fraction of them. This builds that set greedily and then counts the coverage rather than claiming it, and says plainly what pairwise does not catch.
What this generator does
Selects cases greedily so that every pair of values from two different parameters appears together in at least one of them, then counts the pairs actually covered and compares the case count against exhaustive testing.
How to use this tool
- Choose how many parameters to vary.
- Read the case table — each row is one test to write.
- Compare the case count against testing everything.
- Copy the table straight into a test suite.
Understanding the controls
- How many parameters
- Between 2 and 5, drawn from authentication state, role, resource state, request origin and rate limit.
- Seed
- Reproduces exactly the same set of cases, so a suite can be regenerated identically.
Common use cases
- Cutting an authorisation test matrix to a manageable size
- Showing what pairwise coverage does and does not guarantee
- Planning combination coverage before a single test is written
- Reviewing whether a suite covers the states that interact
- Reproducing the same case set from a seed
How this generator works
Each round tries several random candidates and keeps whichever covers the most pairs not yet seen, repeating until none are left. That terminates with full pairwise coverage, which is what the page promises. The check recounts every pair against the finished cases and requires none to be missing.
Randomness and fairness
Which cases are chosen is random within the coverage constraint; the coverage itself is guaranteed and verified. Seeded runs reproduce exactly and are therefore explicitly not cryptographically secure, and unseeded ones use the browser's cryptographically secure generator.
For how randomness is produced across the whole site, see how Generate Random works.
Limitations and good to know
- Pairwise coverage misses bugs that need three specific values at once — it is a strategy, not a proof.
- The greedy selection is not minimal; a dedicated solver would find fewer cases.
- Parameters and their values come from a fixed list rather than your own system.
- No expected outcomes are given, only the input combinations.
- Case sets are not stored between visits.
Privacy and your data
Cases are generated in your browser. Nothing about them or your seed leaves the page.
Related generators
- Permission Matrix GeneratorEvery role, resource and action combination laid out as a checklist, with the denials listed because those are the ones worth testing.
- Token Lifetime Scenario GeneratorBoundary test cases for session and token expiry, including the clock-skew window that trips most implementations.
- Test Matrix GeneratorTurn parameters and their values into a test matrix — full factorial, a random sample, or all-pairs coverage in a fraction of the cases.
- Input Validation Scenario GeneratorLength-rule test cases sitting exactly on each boundary and either side, plus the whitespace cases people forget.