How to test a video conferencing tool

Shipped untested, a video conferencing tool lets an uninvited participant join with a guessed or shared meeting ID and take over screen share before the host can remove them, and installs a hidden desktop helper that bypasses a browser safeguard and stays after the app is deleted. 9 tests are mandatory here, each tied to a risk in the map below. After the release smoke check, start the risk tests with regression tests: the intruder, recording-access and uninstall cases must rerun every time meeting controls change.

9 mandatory testsfirst: regression suite

What counts as a video conferencing tool

A video conferencing tool here runs meetings with audio, video, screen share and recording through web, desktop, iOS and Android clients, joined by link or meeting ID. It counts when cloud recordings are stored, when desktop clients ship as installers and when encryption is advertised. A one-to-one chat app with occasional calls is out of scope, and so is a one-way live streaming service with no participant controls.

Adjacent product types not covered here

identity and access management service: An identity and access management service guards sign-in to other apps, while a meeting can be joined from a link or ID with no account at all.
e-signature service: An e-signature service opens one contract per emailed link, so consent disclosure and tamper evidence lead instead of meeting intruders and a hidden desktop helper.
messaging app: A messaging app carries ongoing group chats where child contact and reconnect storms lead, while a meeting tool's risks sit in joinable meeting IDs and a desktop helper left after uninstall.
desktop application: A desktop application shares the local helper and notarization risks, but has no meeting IDs, recordings or live captions to test.

Risk map

5 risks attached to video conferencing tool with evidence. Sorted by severity.
Risk		Grade	Note	Evidence
Fraud or abuse by users fraud-abuse	money	practitioner single incident, no second source	An uninvited participant joins with a guessed or shared meeting ID and takes over screen share before the host can mute or remove them.	ev-0323
Accessibility complaint or lawsuit accessibility-liability	legal	primary	Live speech in a call has no captions for a deaf participant, and a screen-reader user cannot reach mute, leave or chat controls during the call.	ev-0016
Fine or enforcement by a regulator regulatory-penalty	legal	primary	The tool advertises end-to-end encryption it does not provide, says cloud recordings are encrypted when some sit unencrypted on a server, and a desktop helper installs a hidden local web server that bypasses a browser safeguard and stays after the app is deleted.	ev-0221
Personal or sensitive data exposed data-breach	data	primary	A social-login SDK in the iOS meeting client collects device information, and a hidden local web server installed by the Mac client stays after the app is deleted.	ev-0221 ev-0322
App rejected or removed by a store store-rejection	distribution	secondary by design analysis	The macOS client or its auto-join helper fails notarization, or the mobile build asks for camera and microphone without a stated purpose, and review blocks the release.	ev-0001 ev-0002 ev-0009

Mandatory tests (9)

Step 1: release smoke tests
Why:data-breach store-rejection
Done when: On every build, each client installs from the store or notarized build without a warning, two test accounts on different platforms join a passcode meeting, see and hear each other, share a screen, the host ends the meeting for all, and after the desktop client is uninstalled a test web page can no longer start or join a meeting through it.
Tool class: browser automation. Who usually runs it: QA engineer.
Step 2: regression suite
Why:fraud-abuse data-breach
Done when: The intruder, recording-access and uninstall cases rerun on every release, and any intruder join blocks the release.
Tool class: test management. Who usually runs it: QA engineer.
Step 3: penetration testing
Why:fraud-abuse data-breach
Done when: A tester without an invite cannot join a passcode or waiting-room meeting by guessing IDs, and cannot open a cloud recording link without signing in as an allowed user.
Tool class: proxy. Who usually runs it: security specialist.
Step 4: end-to-end functional tests
Why:fraud-abuse
Done when: Waiting room, passcode, meeting lock, remove participant and host-only screen share each stop a test intruder account in a scripted meeting.
Tool class: browser automation. Who usually runs it: QA engineer.
Step 5: compliance checks
Why:regulatory-penalty data-breach
Done when: Every security claim in marketing and in the app (encryption type, recording storage) matches a design document signed by a security specialist, and the release notes name every helper or local service the desktop installer adds.
Tool class: test management. Who usually runs it: product manager.
Step 6: accessibility testing
Why:accessibility-liability
Done when: A screen-reader user joins, mutes, raises a hand and reads chat by keyboard alone, and live captions appear for a speaking test user.
Tool class: accessibility checker. Who usually runs it: accessibility specialist.
Step 7: integration tests
Why:data-breach
Done when: A proxy capture of app open shows no third-party SDK sending device data before the user picks that SDK's feature.
Tool class: proxy. Who usually runs it: developer.
Step 8: security scanning
Why:data-breach
Done when: The scan of client builds and the recording service has no open high findings, and the desktop installer leaves no local web server listening after uninstall.
Tool class: SAST scanner. Who usually runs it: security specialist.
Step 9: device and browser compatibility
Why:store-rejection
Done when: The current and previous OS versions on iOS, Android, Windows and macOS install the client, pass notarization or store pre-checks, and join the same meeting.
Tool class: device cloud. Who usually runs it: QA engineer.

Recommended and optional tests

performance and load testingrecommended
Becomes mandatory when outage-under-load evidence for meeting peaks is attached.
resilience and failure testingrecommended
Becomes mandatory when dependency-failure evidence for a media provider or region is attached.
offline and poor-network testingrecommended
Becomes mandatory when lost-actions evidence for dropped calls is attached.
unit testsoptional
Optional: supports the intruder cases with code-level checks on meeting ID generation.
exploratory testingoptional
Optional: finds role combinations that scripted cases miss.
usability testingoptional
Optional: helps when hosts miss controls during an intrusion.
localization testingoptional
Optional: helps when clients ship in several languages, no attached risk depends on it.

Not needed and why

data integrity and migration testing
Not needed: no data-corruption risk is attached. Becomes recommended when meeting records feed billing or compliance archives.
analytics and event tracking tests
Not needed: no wrong-decisions risk is attached. Becomes recommended when usage reports drive seat billing.

Order of work

First release

release smoke tests: Install each client from the store or notarized build, have two test accounts on different platforms join a passcode meeting, see and hear each other and share a screen, have the host end the meeting for all, then uninstall the desktop client and confirm a test web page can no longer start or join a meeting through it.
regression suite: Rerun the intruder, recording-access and uninstall cases and block the release on any intruder join.
penetration testing: Have a tester without an invite guess meeting IDs for passcode and waiting-room meetings and open cloud recording links without signing in as an allowed user.
end-to-end functional tests: In a scripted meeting, send a test intruder account against the waiting room, passcode, meeting lock, remove participant and host-only screen share controls.
compliance checks: Match every security claim in marketing and in the app, including encryption type and recording storage, to a design document signed by a security specialist, and check the release notes name every helper or local service the desktop installer adds.
accessibility testing: Have a screen-reader user join, mute, raise a hand and read chat by keyboard alone, and check live captions appear for a speaking test user.
integration tests: Capture the network traffic of app open and confirm no third-party SDK sends device data before the user picks that SDK's feature.
security scanning: Scan client builds and the recording service, then uninstall the desktop client and confirm no local web server is still listening.
device and browser compatibility: Install the client on the current and previous OS versions of iOS, Android, Windows and macOS, pass notarization or store pre-checks, and join the same meeting from each.

Ongoing cadence

release smoke tests: On every build of every client.
regression suite: On every release that changes meeting controls.
device and browser compatibility: Before each store submission and each notarized installer, and when a new OS version is published.
compliance checks: After each change to encryption, recording storage or the security claims in marketing.
integration tests: When a third-party SDK is added to or updated in a client.
security scanning: On every desktop installer build and recording service change.
performance and load testing: When the plan's maximum participant count is raised.

Tools

Listed alphabetically inside each test type, filtered to the tests above and to the platforms of video conferencing tool (web, desktop, ios, android). Not recommendations.

release smoke tests

Firebase Test LabRuns app tests on hosted devices. iosandroidfreemium
TestRailTest case and run management. webiosandroidapicommercial
XrayTest management inside Jira. webiosandroidapicommercial

regression suite

CypressBrowser-based end-to-end testing with a visual runner. webfreemium
PlaywrightBrowser automation for Chromium, Firefox and WebKit. webopen-source
PromptfooEvaluation and regression tests for LLM prompts and outputs. apiwebopen-source
TestRailTest case and run management. webiosandroidapicommercial
XrayTest management inside Jira. webiosandroidapicommercial

penetration testing

Burp SuiteProxy and scanner for web application security testing. webapifreemium

end-to-end functional tests

AppiumCross-platform mobile UI automation over WebDriver. iosandroidopen-source
ApplitoolsVisual comparison of screens across builds. webiosandroidcommercial
BrowserStackCloud of real devices and browsers. webiosandroidcommercial
CypressBrowser-based end-to-end testing with a visual runner. webfreemium
DetoxGray-box end-to-end testing for React Native apps. iosandroidopen-source
EspressoAndroid UI testing framework from Google. androidopen-source
LambdaTestCloud browser and device grid. webiosandroidcommercial
MaestroMobile UI flows written in YAML. iosandroidfreemium
PercyVisual review of UI changes. webcommercial
PlaywrightBrowser automation for Chromium, Firefox and WebKit. webopen-source
PromptfooEvaluation and regression tests for LLM prompts and outputs. apiwebopen-source
Sauce LabsCloud test infrastructure for web and mobile. webiosandroidcommercial
SeleniumWebDriver-based browser automation. webopen-source
XCTestApple's framework for unit and UI tests. iosopen-source

accessibility testing

Accessibility ScannerGoogle's on-device accessibility checker for Android. androidopen-source
axe-coreAccessibility rules engine for automated checks. webopen-source
LighthouseAudits for accessibility and performance in Chrome. webopen-source
Pa11yCommand-line accessibility testing. webopen-source

integration tests

Charles ProxyHTTP proxy for inspecting and throttling traffic. iosandroidwebcommercial
JestJavaScript test runner with mocking and snapshots. webapiopen-source
JUnitTest framework for the JVM. apiandroidopen-source
VitestTest runner for Vite-based JavaScript and TypeScript projects. webapiopen-source
XCTestApple's framework for unit and UI tests. iosopen-source

security scanning

Burp SuiteProxy and scanner for web application security testing. webapifreemium
mitmproxyInteractive HTTPS proxy. iosandroidwebapiopen-source
MobSFStatic and dynamic analysis for mobile binaries. iosandroidopen-source
OWASP ZAPDynamic application security scanner. webapiopen-source
SemgrepStatic analysis with custom rules. apiwebiosandroidfreemium
SnykDependency and code vulnerability scanning. apiwebiosandroidfreemium

device and browser compatibility

AppiumCross-platform mobile UI automation over WebDriver. iosandroidopen-source
ApplitoolsVisual comparison of screens across builds. webiosandroidcommercial
BrowserStackCloud of real devices and browsers. webiosandroidcommercial
Firebase Test LabRuns app tests on hosted devices. iosandroidfreemium
LambdaTestCloud browser and device grid. webiosandroidcommercial
PercyVisual review of UI changes. webcommercial
PlaywrightBrowser automation for Chromium, Firefox and WebKit. webopen-source
Sauce LabsCloud test infrastructure for web and mobile. webiosandroidcommercial
SeleniumWebDriver-based browser automation. webopen-source

performance and load testing

ArtilleryLoad testing with YAML scenarios. apiwebfreemium
GatlingLoad testing with Scala, Java or Kotlin scenarios. apiwebfreemium
JMeterLoad testing tool from the Apache Foundation. apiwebopen-source
k6Load testing scripted in JavaScript. apiwebopen-source
LighthouseAudits for accessibility and performance in Chrome. webopen-source
LocustLoad testing scripted in Python. apiwebopen-source

offline and poor-network testing

Charles ProxyHTTP proxy for inspecting and throttling traffic. iosandroidwebcommercial
mitmproxyInteractive HTTPS proxy. iosandroidwebapiopen-source
Network Link ConditionerApple tool for simulating poor network conditions. iosopen-source

What to send to the person who will test

Send the checklist and the brief below. The printable checklist for video conferencing tool has the same 9 items with checkboxes.

Download the checklist Markdown CSV Brief (Markdown)

Acceptance criteria wording

A release of the video conferencing tool is accepted when two test accounts on different platforms join a passcode meeting, see and hear each other and share a screen, and a test intruder account is stopped by the waiting room, passcode, meeting lock and host-only screen share. Every encryption and recording claim matches a signed design document, and the desktop installer leaves no local web server listening after uninstall.

Brief

# Test brief: video conferencing tool

Product type: video conferencing tool. Meetings with audio, video, screen share and recording.
Risk map and evidence: https://howtotestaproduct.com/how-to-test/video-conferencing/
Printable checklist: https://howtotestaproduct.com/checklists/video-conferencing/

Run these 9 mandatory tests in this order. A test is done only when its done condition is true on the build you will release.

1. release smoke tests (risks: data-breach, store-rejection). Tool class: browser automation. Usually run by: QA engineer.
Done when: On every build, each client installs from the store or notarized build without a warning, two test accounts on different platforms join a passcode meeting, see and hear each other, share a screen, the host ends the meeting for all, and after the desktop client is uninstalled a test web page can no longer start or join a meeting through it.
2. regression suite (risks: fraud-abuse, data-breach). Tool class: test management. Usually run by: QA engineer.
Done when: The intruder, recording-access and uninstall cases rerun on every release, and any intruder join blocks the release.
3. penetration testing (risks: fraud-abuse, data-breach). Tool class: proxy. Usually run by: security specialist.
Done when: A tester without an invite cannot join a passcode or waiting-room meeting by guessing IDs, and cannot open a cloud recording link without signing in as an allowed user.
4. end-to-end functional tests (risks: fraud-abuse). Tool class: browser automation. Usually run by: QA engineer.
Done when: Waiting room, passcode, meeting lock, remove participant and host-only screen share each stop a test intruder account in a scripted meeting.
5. compliance checks (risks: regulatory-penalty, data-breach). Tool class: test management. Usually run by: product manager.
Done when: Every security claim in marketing and in the app (encryption type, recording storage) matches a design document signed by a security specialist, and the release notes name every helper or local service the desktop installer adds.
6. accessibility testing (risks: accessibility-liability). Tool class: accessibility checker. Usually run by: accessibility specialist.
Done when: A screen-reader user joins, mutes, raises a hand and reads chat by keyboard alone, and live captions appear for a speaking test user.
7. integration tests (risks: data-breach). Tool class: proxy. Usually run by: developer.
Done when: A proxy capture of app open shows no third-party SDK sending device data before the user picks that SDK's feature.
8. security scanning (risks: data-breach). Tool class: SAST scanner. Usually run by: security specialist.
Done when: The scan of client builds and the recording service has no open high findings, and the desktop installer leaves no local web server listening after uninstall.
9. device and browser compatibility (risks: store-rejection). Tool class: device cloud. Usually run by: QA engineer.
Done when: The current and previous OS versions on iOS, Android, Windows and macOS install the client, pass notarization or store pre-checks, and join the same meeting.

Acceptance criteria wording:
A release of the video conferencing tool is accepted when two test accounts on different platforms join a passcode meeting, see and hear each other and share a screen, and a test intruder account is stopped by the waiting room, passcode, meeting lock and host-only screen share. Every encryption and recording claim matches a signed design document, and the desktop installer leaves no local web server listening after uninstall.

Report back for each test: pass or fail against its done condition, the build or version tested, and the proof (screenshot, log line or report file).

Licence: CC BY 4.0.

For founders: what to forward and what to ask back. For product managers: turning this page into tickets.

Questions about testing a video conferencing tool

What testing does a video conferencing tool need?

9 tests are mandatory, starting with a cross-platform meeting smoke run on every build and the intruder, recording-access and uninstall regression cases. Each is tied to one of the 5 risks in the map: meeting intruders, device data sent by an embedded login SDK, false encryption and recording claims with a hidden desktop helper left after uninstall, store and notarization blocks, and missing captions and screen-reader access. Performance, resilience and offline tests are recommended, each with the evidence that makes it mandatory.

What gets a video conferencing tool rejected by an app store?

The map marks store rejection as a by design analysis risk: the macOS client or its auto-join helper fails notarization, or the mobile build asks for camera and microphone without a stated purpose. Compatibility testing installs the client on the current and previous OS versions and passes notarization or store pre-checks before each release.

What is the minimum testing for a video conferencing tool at MVP stage?

The minimum is the 9 mandatory tests once meetings are joined by link or ID, desktop clients ship as installers and encryption is advertised. Unit tests on meeting ID generation, exploratory, usability and localization testing are optional, and data integrity and analytics tests that vendors often add are not needed until the conditions on the page change.

Which tests in a vendor test plan for a video conferencing tool are not needed?

Data integrity testing is not needed while no data-corruption risk is attached, until meeting records feed billing or compliance archives. Analytics tests are not needed while no wrong-decisions risk is attached, until usage reports drive seat billing.

When is test automation worth it for a video conferencing tool?

Automation pays for the cross-platform meeting smoke run on every build and the scripted intruder meeting that tries each host control. The design document review of encryption claims and the screen-reader run with live captions stay with people.

Evidence

ev-0323post-mortemprimary
A Message to Our Users, Zoom
Official company statement: uninvited participants disrupted meetings, and the company pointed hosts to waiting rooms, passwords, muting controls and limits on screen sharing. Supports fraud-abuse for video conferencing tools with joinable meeting links.
published 2020-04-01 · verified 2026-10-07
ev-0016standardprimary
Web Content Accessibility Guidelines (WCAG) 2.2, W3C
WCAG 2.2 is the W3C standard that accessibility law and procurement rules reference; level AA is the usual target.
published undated · verified 2026-10-07
ev-0221regulatorprimary
FTC Requires Zoom to Enhance its Security Practices as Part of Settlement, Federal Trade Commission
The FTC also alleged that the company compromised the security of some users when it secretly installed software, called a ZoomOpener web server, as part of a manual update for its Mac desktop application in July 2018.
Regulator order: a Mac desktop app update installed a hidden local web server that bypassed a browser safeguard, stayed after the app was deleted and could reinstall it. The order also states the company advertised end-to-end encryption it did not provide and said cloud recordings were encrypted when some were stored unencrypted on its servers before transfer. Supports regulatory-penalty and data-breach for desktop applications and video conferencing tools.
published 2020-11-09 · verified 2026-10-07
ev-0322post-mortemprimary
Zoom's Use of Facebook's SDK in iOS Client, Zoom
Official company statement: a social login SDK in the iOS meeting client was collecting device information, and the company removed it and moved that login to the browser. Supports data-breach for video conferencing clients that embed third-party SDKs.
published 2020-03-27 · verified 2026-10-07
ev-0001store-guidelineprimary
App Review Guidelines, Apple
Apple reviews every iOS, iPadOS and macOS App Store submission against these guidelines, including crashes and bugs at review, privacy disclosures, in-app purchase rules and extra rules for medical, financial and kids apps, and apps with user-generated content must let users report offensive content and block abusive users (guideline 1.2), and apps offering loot boxes or similar mechanisms must disclose the odds of each item type before purchase (guideline 3.1.1).
published undated · verified 2026-10-07
ev-0002store-guidelineprimary
Developer Program Policy, Google Play
Google Play applies these policies to every Android app it distributes and can reject, suspend or remove apps that violate them.
published undated · verified 2026-10-07
ev-0009store-guidelineprimary
Notarizing macOS software before distribution, Apple
Apple requires Developer ID software distributed outside the Mac App Store to be notarized; Gatekeeper blocks software that is not.
published undated · verified 2026-10-07

Disclaimer

This page lists tests and risks for a product category, not for your product. Risks are attached only with the evidence shown in the Evidence section. Tools are listed alphabetically and are not recommendations. Nothing here is legal, regulatory or security advice; where a regulator or a store sets a requirement, their page is linked and takes precedence.

How to test a video conferencing tool

01Direct answer

02What counts as a video conferencing tool

Adjacent product types not covered here

03Risk map

04Mandatory tests (9)

Step 1: release smoke tests

Step 2: regression suite

Step 3: penetration testing

Step 4: end-to-end functional tests

Step 5: compliance checks

Step 6: accessibility testing

Step 7: integration tests

Step 8: security scanning

Step 9: device and browser compatibility

05Recommended and optional tests

06Not needed and why

07Order of work