# What Testmode can and cannot test URL: https://testmode.ai/docs/what-testmode-can-test/ > Check whether your web app fits Testmode: a reachable URL, username and password login, a desktop browser. Covers MFA, CAPTCHA, SSO and VPNs. Testmode tests web apps that are reachable from the public internet, in a desktop-sized cloud browser, and logs in with a username and a password. This page covers the common edge cases, such as MFA, CAPTCHA, SSO, VPNs, payment iframes, new tabs and mobile layouts, and says plainly what is not supported. ## What makes a good fit? Your app is a good fit when most of these are true: | Your app | Fit | | --- | --- | | A web app with a public URL, such as a staging or production site | Good fit | | Users log in with a username or email and a password | Good fit | | The flows you test stay on one site, such as search, cart, forms and account pages | Good fit | | You can use test accounts without MFA and an environment without CAPTCHA | Good fit | | Runs only on `localhost`, a VPN or an intranet | Not reachable | | Needs a one-time code, SSO or Google sign-in to log in | Not supported | | A native mobile app, desktop app or API | Not supported | The Toolshop practice shop is a good example. Searching the catalog, filtering by category, adding a product to the cart and checking the contact form's validation all fit. ## Can Testmode test localhost, a VPN or an IP allowlist? Not directly. Tests run in a cloud browser, so the environment's Base URL must be reachable from the public internet. - **`localhost` and intranet sites** can't be reached. - **Sites behind a VPN** can't be reached. - **IP allowlists** don't help, because Testmode does not offer fixed IP addresses to allowlist. Deploy the app to an environment that is publicly reachable, such as a staging site, and test that. ## Can Testmode log in with MFA, one-time codes, SSO or Google? Testmode logs in with a credential that holds a username, a password and an optional Login URL. Anything beyond that is not supported: - **MFA, SMS or email codes, and magic links.** Testmode has no way to receive a code or read an inbox, so these logins can't be completed. Use a test account without them. - **Google sign-in, SSO and other identity providers.** These are not supported as a test flow. The Toolshop's login page has a Google button, for example; tests log in with an email address and a password instead. - **Logins that hand off to another domain.** Whether they work is not guaranteed. Learn how automatic login works in [Credentials and automatic login](https://testmode.ai/docs/credentials-and-automatic-login/). ## What about CAPTCHA, bot protection and firewalls? - **CAPTCHA.** Testmode does not solve CAPTCHAs. Turn CAPTCHA off in the environment you test. - **Bot protection and firewalls.** These may block cloud browsers. If a test's screenshots show a challenge or an error page instead of your app, allow test traffic in the environment you test. ## Can tests fill in payment forms and embedded iframes? The agent's view of a page includes content inside iframes. Card fields embedded from a payment provider on another domain are not guaranteed to work, though. A checkout that sends the browser to a hosted payment page on another domain is not guaranteed either, because the agent is instructed to stay on your site. Use a test payment method that stays on your site. On the Toolshop, for example, a checkout test pays with `Cash on Delivery`. **Caution** A checkout test places a real order, and a contact form test sends a real message. Run tests like these only against environments meant for testing. ## What about new tabs, pop-ups and browser dialogs? The agent follows the browser's active tab and has no way to switch tabs. These are not guaranteed to work: - Links that open in a new tab - Sign-in pop-up windows - Native browser `alert` and `confirm` dialogs If a link opens a page in a new tab, start the test on that page directly with **Start Path**. ## Can Testmode test mobile and responsive layouts? No. Tests use a desktop-sized browser window. There is no mobile device emulation, and you can't choose a browser or device. ## How do tests handle cookie consent banners? Each test starts in a fresh browser. A test without a credential sees your site as a new visitor, including any cookie banner. - **With automatic login**, Testmode dismisses a cookie banner before it fills in the login form. Later tests with that credential start with the cookies and site storage saved after that login, so the banner may already be gone. - **Without login**, add a step such as `Accept the cookie banner if it appears` when the banner covers the page. Ads are blocked in test browsers, so ads and layouts that depend on them are not tested faithfully. ## Can I test sites that aren't in English? Your site can be in any language. Quote its labels exactly as the site shows them, for example `Click "Inloggen"`. The Testmode app is in English, and dictation, in the test case editor and the Assistant, recognizes US English only. Writing the steps themselves in another language is not officially supported. ## Does a test stay on one site? The agent can navigate directly only to the host your test starts on and its subdomains. A test that starts on `app.example.com` can go to `shop.app.example.com`, but not to `example.com` or `auth.example.com`. This is not a security boundary. The agent is told to stay on your site, but clicking a link that leads elsewhere is not blocked. Automatic login is not held to this rule. ## What can't a test do? A test can click, type, fill in fields, choose options in dropdowns, press keys, hover, scroll up and down, go back and wait. It cannot: - Upload or download files - Drag and drop, right-click or double-click - Scroll sideways - Read email or SMS - Run custom JavaScript A test also needs something to check. Test cases with no steps and no **Expected Outcome** are skipped when a run starts, and cost nothing. Runs start from the Testmode app or from a schedule. There is no CI, API or deploy-hook trigger. ## How long can a test run? Each test has a time limit, which covers the test from its start page to the verdict: - the test case's **Maximum duration (minutes)**, if you set one - otherwise, the project's **Default test duration (minutes)** under **Settings** > **General** - otherwise, 15 minutes You can set either field to a whole number from 1 to 60. A test that reaches its limit fails with a reason that starts with "Timed out:". Testmode doesn't promise how long a test takes, because that depends on your app and your steps. A test can also end sooner. When the agent stops making progress, for example by repeating the same action on a page that doesn't change, Testmode stops the test with a reason that starts with "Stopped early:". That usually means a step doesn't match what the page offers. Long journeys are better split into several shorter test cases. See [How Testmode runs a test](https://testmode.ai/docs/how-testmode-runs-a-test/). ## What if my app allows only one session per user? Tests in a run can run at the same time, and tests with the same credential share one sign-in. Some apps allow only one active session per user and sign the other browsers out. For those apps, set the credential's **Parallel browser sessions (optional)** to `1`. Tests with that credential then run one at a time, and the others wait as `Queued` until a browser using the credential finishes. A higher number allows that many browsers at once, up to 50. Tests that sign in as the same user also change that user's data at the same time. If two tests use the same cart or profile, give them different credentials, or limit the credential in the same way. See [Credentials and automatic login](https://testmode.ai/docs/credentials-and-automatic-login/). ## How can I work around common limits? | Limit | Workaround | | --- | --- | | MFA or one-time codes | Use a test account without MFA in the environment you test. | | CAPTCHA or bot protection | Turn CAPTCHA off and allow test traffic in that environment. | | App only on `localhost` or a VPN | Test a publicly reachable staging site. | | Payment on another domain | Use a test payment method that stays on your site. | | A link opens a new tab | Start the test on the target page with **Start Path**. | | One active session per user | Set the credential's **Parallel browser sessions (optional)** to `1`. | | Long journeys | Split them into several shorter test cases, or raise **Maximum duration (minutes)**, up to 60. | ## Related - [Credentials and automatic login](https://testmode.ai/docs/credentials-and-automatic-login/): Store a test login and let Testmode sign in first. - [Troubleshoot login](https://testmode.ai/docs/troubleshoot-login/): Fix tests that fail with a Login failed reason. - [Limits and defaults](https://testmode.ai/docs/limits/): Time limits, credential sessions, schedules, list sizes and more. - [FAQ](https://testmode.ai/docs/faq/): Answers to common questions.