No. TestMaadu builds code from what it finds on the page and in the request, using its own rules, inside your browser. There is no AI model to pay for, no API key to paste in and no usage meter.

No. Inspected pages, API requests and responses, performance timings, recorded journeys, security findings and generated code are never sent to us or anyone else. Only your Google sign-in and your trial or lifetime status talk to our server.

Nothing about your API calls is saved to local storage or disk. The call you select is held only in temporary browser memory and is cleared when you refresh the page, close the tab or close the browser. Swagger test keeps the spec and the responses in the panel’s memory and saves only the last spec link and server. The Privacy Policy has the details.

While you record, TestMaadu writes a step for each click, double-click, right-click, hover menu, typed value, key press, dropdown choice, upload, drag and drop, new tab and alert popup on the tab you are recording. End Recording stops it and takes a screenshot of the visible tab, which you can mark up. You add a title, expected and actual result if you want them, and choose a severity.

The report holds the steps with their test data, the screenshot, console errors, the last element you used and the environment (browser, screen, start and captured URL, page title, time zone, language and app version). With lifetime access it also holds every step past the fifth, the failed API calls with a cURL command for each, slow calls, the Playwright or Cypress repro test, and a zip with the test script, network.har, api-errors.json and console.txt.

Yes. During the trial you get all of it. After the trial, Log a Bug keeps working for free with steps 1 to 5, the screenshot editor with the page URL, console errors, the element snapshot and environment details, and you can still copy the bug, copy the screenshot and download the zip.

Lifetime access adds every step, the Playwright or Cypress repro test, API errors and slow calls, Copy as cURL, network.har and api-errors.json in the zip, and removes the “Made with TestMaadu” line from copied reports. Compare plans

No. The recording, screenshot and evidence stay in the extension and leave your browser only when you click Copy bug, Copy screenshot or Download zip. Passwords are never read, and tokens, cookies and secret URL values are masked in what you export unless you choose to show them.

Copy bug puts a formatted report on your clipboard that you paste into the description of a Jira, Azure DevOps, GitHub or Linear issue, a Slack message or an email, then Copy screenshot adds the image. There is no direct connection to those tools yet.

Yes. In the side panel, open API Tests and choose the test type Swagger test. Paste the link to your Swagger 2.0 or OpenAPI 3 file (JSON or YAML) and press Load, or open your Swagger page and press Use this page’s spec. Tick the endpoints you want. One endpoint shows its Playwright test straight away, built from the Swagger example; several download as one zip in TypeScript, JavaScript or Python, one test file per endpoint, with BASE_URL and environment variables for tokens and keys.

The spec and the responses stay in the panel’s memory. Only the last link and server are saved, in the extension on your device, and nothing is sent to TestMaadu. Execute sends a request to your API only when you click it, and asks once more for POST, PUT, PATCH and DELETE. After the trial you can still load, pick and Execute, with each test shown in part; the zip of many endpoints is part of lifetime access.

Yes. With the test type set to JMeter load test (the default), you press Record journey in the side panel, use your site like a real user and press Stop. TestMaadu lists the calls, links the values passed between steps, sets up test data and writes a load test for JMeter (plan.jmx) or k6 (script.js), with a load profile and pass/fail targets for p95 response time and errors.

You run that plan yourself in Apache JMeter or k6, on your machine or a load-test server. TestMaadu writes the plan. It never sends the load itself. The README in the zip has the install and run steps, for example jmeter -n -t plan.jmx -q user.properties -l results.jtl -e -o report.

The second test type, Quick check, times one API from DevTools: one warm-up call, then 5 to 50 calls one at a time, and it fails when p95 goes over your budget. It is a response-time check for a single API, not a load test.

No. Passwords are never recorded. In users.csv the recorded login has its password written as CHANGE_ME, and you fill in the passwords of your test users. Each user logs in once per run.

The recorded journey (pages, form fields except passwords, API calls and values found in responses) is kept only in temporary browser memory, and cleared after 2 hours or when you close the browser. Nothing is sent to a server. The Privacy Policy has the details.

Be careful. Both test types repeat calls, so a write call can create or change data many times. In Quick check, GET is the default; for POST, PUT, PATCH and DELETE, TestMaadu shows a warning and asks you to confirm before it generates the code. A JMeter load test of a journey that changes data, such as adding to a cart, asks you to tick that it is a test environment, not production, before you can download it.

Run load tests only against systems you own or are authorised to test.

Find Element generates Playwright code in TypeScript, JavaScript and Python, Cypress code in TypeScript and JavaScript, and Selenium code in JavaScript and Python. Switching keeps the element selected and rebuilds the code. The Log a Bug test script is Playwright or Cypress, in TypeScript or JavaScript. API Automation (Live test and Swagger test) and Quick check generate Playwright tests in TypeScript, JavaScript and Python. The JMeter load test is written for JMeter (.jmx, built-in elements only, no plugins) or k6 (JavaScript). Security regression tests are Playwright (TypeScript, JavaScript or Python) or Cypress (TypeScript or JavaScript).

Verify runs the chosen action against the live element, such as a click or typing a test value. It turns green only when it really worked, and red with “Not found” when it did not, so you know the code works before you copy it.

Freeze is for things that disappear: menus, tooltips and toasts. Press Freeze, open the menu or trigger the toast during the 3-second count, and the page is held still so you can click anything in the picture. Alt + Shift + F freezes at once, and Esc cancels.

Yes, with lifetime access (and during the trial). Your recorded steps become a test using locators from the Find Element engine. The Language dropdown on the Test script tab picks Playwright TypeScript or JavaScript, or Cypress TypeScript or JavaScript (repro.spec.ts, repro.spec.js, repro.cy.ts or repro.cy.js), and Copy test and Download zip follow it. If an API call failed while you recorded, the test includes a live BUG CHECK that fails while the bug is still there. New tabs, popups, alerts, file uploads and iframes are handled, and masked values such as emails become empty testData entries that you fill in or set as environment variables.

Steps that cannot be automated become a plain-English TODO, and Pick element on the Review screen turns a TODO into code. The header tells you how many steps were automated.

Press Check this page and TestMaadu runs passive security checks in nine areas: security headers, Content Security Policy (with a CSP grade), session cookies, CORS, mixed content, exposed secrets (in URLs, storage, hidden fields and HTML comments), risky forms, debug leftovers such as dev builds, source maps and staging calls, and JWT tokens.

You get a grade from A to F, findings grouped by area with why each one matters, the evidence with secrets masked, the OWASP category and how to fix it for your server or framework. Generate tests writes regression tests in Playwright or Cypress that fail while the problem is there and pass once it is fixed. Download report saves a zip for your developers, and Log as bug turns a finding into a bug report.

No to both. The checks are passive: TestMaadu only reads the page, its cookies and its response headers. The headers come from DevTools when it is open, otherwise from one re-request of the page, which is skipped for logout, delete, confirm, reset and OAuth sign-in links, and for URLs that carry tokens or one-time codes. Nothing is attacked.

It covers the repeatable, everyday checks you can run on every page and every build. It does not replace a security tester or a full security review. Run the generated tests only against applications you own or are authorised to test.

After the trial you still get all 9 checks, the grade and every finding’s title, the first 3 findings in full, the JWT decoder, Ignore on this site, Check again and the Passed list. Lifetime access adds the evidence and fix for every finding, the regression tests with Copy and Download, Download report, and finding.json and the test in the bug zip. Compare plans

On any site you can open in Chrome or Edge, including your own staging and local apps. Browsers do not let extensions read a few pages, such as the Chrome Web Store, Edge Add-ons and chrome:// or edge:// pages, so those cannot be inspected.

Not by default. Authorization headers and cookies become environment-variable references such as process.env.TESTMAADU_AUTHORIZATION. Replaying captured authentication is off until you turn it on, and you choose whether any literal value is included.

No. TestMaadu is an extension for Google Chrome and Microsoft Edge. The code it generates runs in your own Playwright, Cypress or Selenium project.

Each tab shows “Your trial has expired. Free features still work.” with a Get lifetime access · ₹699 button, and the header pill says Trial expired. Generated code is shown only in part and copying is turned off until you unlock lifetime access. The locator stays free to copy for 3 selected elements a day, Log a Bug keeps working with its free features, Swagger test still loads, picks and executes, the Quick check snapshot stays visible, the 1-user Smoke load test plan stays free, and Security keeps working with its free features. Your account and settings stay as they were.

Get lifetime access opens one window that lists what each tab unlocks. You pay ₹699 once in that same window, and an “Enjoy Maadi!” receipt confirms it.

All sales are final, which is why TestMaadu is free to try first: a day without signing in, then a trial with Google sign-in. The exception is a payment error, such as a double charge or a payment that did not unlock your access. Email us within 7 days. The Refund Policy has the details.

Google Chrome 114 or newer, and Microsoft Edge. The same extension works in both, from the Chrome Web Store or Microsoft Edge Add-ons.