Developer docs
Auto Light Dark
Developer docs
Auto Light Dark
Breadcrumbs

Test User Guide

Last Updated: September 16, 2026

The Test User Dashboard (TUD) has been deprecated.

tud.vfs.va.gov is no longer available. To continue finding and using test accounts follow the guide below.

An essential aspect of creating a QA test plan for your product is the setup of test users and associated data. VA.gov maintains a catalog of several dozen high-quality test user identities in a tool we call the Test User Dashboard (TUD). The services that each identity is correlated to can be discovered within the TUD, however, the exact details of the data in that service are not yet described.

After reviewing this page you should have a good understanding of test accounts and using the TUD.

Overview

Test accounts are simulated http://VA.gov user login and password credentials that are used to sign-in to the staging environment for testing purposes. The staging site has several hundred test accounts.

Each test account has unique attributes that allow you to simulate the experience of a real user, based on your requirements. Common testing scenarios using test accounts include the following:

  • Conducting QA testing for new features

  • Reviewing a user flow to make sure that all content and designs adhere to the VA Design System (VADS)

  • Testing a feature for compliance with accessibility standards Section 508c and the Web Content Accessibility Guidelines (WCAG)

Who can access it

You need read access to the software/va.gov-team-sensitive repository on va.ghe.com. This is the same access TUD required. If you can open test_users.csv in that repo today, you can use the
replacement site. If you cannot, request va.gov-team-sensitive repo-read access through the standard GitHub access request process before continuing.

How to reach the test user site

The test user site can now be found at:

https://software-va-gov-team-sensitive.pages.va.ghe.com/test-users

Sign in with the GitHub account that has read access to va.gov-team-sensitive.

Finding a test user

The test user site presents the test-user data as a read-only, VA Design System (VADS)-styled
table, the shared spreadsheet published as a cleaner, accessible web view. The columns are:
Email, Password, Security code, Auth type, ID types, First name, Last name, Services.

  1. Open the replacement site to view the test-user table.

  2. Browse or scan the table for an account matching your testing needs, for example, by Auth type
    (LOA, e.g., "LOA3") or ID types (e.g.,"http://ID.me , http://Login.gov ").

  3. Use the copy-to-clipboard affordances to grab the values you need (see masking note below).

Masked, copy-only values. Password and Security code are masked in the UI and never shown
as text; retrieve them with the per-cell Copy button. Email also has a Copy button. Higher-PII
columns (SSN, date of birth, phone, gender, middle name, and the internal UUID/account-id columns) are deliberately not included in the view.

The data shown is exactly what is present in test_users.csv at build time; the CSV is the source of
truth.

Generating a one-time security code (TOTP / MFA)

When a VA.gov staging login prompts for a one-time code:

  • http://ID.me accounts auto-fill their MFA code; you typically do not need to enter one manually.

  • Login.gov accounts require you to enter a one-time code. In the account's Security code
    column, click Get code: the site computes the current time-based code (RFC 6238, 30-second
    period) in your browser from the account's baked-in seed. It displays the current 6-digit code
    (grouped, e.g. 123 456) with an epoch-aligned countdown and progress meter showing the code's true remaining life, and a Copy code control. The code auto-rolls to the next one at the
    30-second boundary (so it won't vanish mid-login), stopping after about 5 minutes and returning to Get code. Paste the code into the login field before its countdown expires.

Notes:

  • Accounts without a seed show an em dash (—) and no Get code button — those accounts have no
    one-time code to generate.

  • A Copy seed control is also available if you need to register the account in an external
    authenticator app; the seed itself is never shown as text.

The replacement site generates the code client-side in your browser — the seed is not sent
anywhere, and no backend or server call is made to produce it. (If you ever need a manual fallback,
use Copy seed and paste the value into a third-party TOTP generator's "Base32 secret" field, but
the built-in Get code action is the supported path.)

Sign-in flow (staging)

  1. On the replacement site, find an appropriate test account in the table and confirm its details meet
    your needs.

  2. Open VA.gov staging in a new tab and choose the matching login type (Login.gov or http://ID.me ).

  3. Copy the account email/username from the table and paste it into the username field.

  4. Copy the account password from the table and paste it into the password field, then sign in.

  5. If prompted for a one-time code, get the current code (auto-filled for http://ID.me ; via the Get code
    action for Login.gov ) and enter it before the countdown expires.

  6. Conduct your testing.

  7. Sign out of VA.gov when finished.

Requesting additions or changes to test users

Test-user data is maintained in test_users.csv in software/va.gov-team-sensitive. To request a new test account, or to change or remove an existing one:

  1. Open an issue or pull request against software/va.gov-team-sensitive describing the account
    addition/change you need (or the correction required).

  2. For questions or help, contact the Platform SRE team in #platform-sre-team (Slack).

Credential handling

Test-account usernames, passwords, MFA seeds, and other authentication material are sensitive. Handle them per the Platform credential-sharing guidelines
(https://depo-platform-documentation.scrollhelp.site/getting-started/credential-sharing-guidelines).
Do not paste them into general chat, tickets, or any location outside the repo-read audience.

Troubleshooting login problems

Sometimes the authentication services have unreported outages and you may not be able to sign-in with Login.gov or ID.me. Also, test account credentials may change without warning. If you’re having trouble logging in with a set of test account credentials, follow the steps below. If you’re still having trouble, reach out in the platform-qa-standards Slack channel to request an update to test accounts.

  1. Confirm you have the correct credentials
    If you found the test account using the TUD, first clear the cookies and cache, then perform a hard refresh on the staging site. Next, confirm your credentials are up-to-date by verifying mvi-staging-users.csv. Finally, try to sign-in again with the same test account.

  2. Try to sign-in with a different test account
    If you're unable to sign-in with a different test account it could mean that a service provider has an outage. If you can sign-in with a different account it could mean the previous test account has outdated information and you should open an issue on GitHub.

  3. Verify staging environment status
    Sometimes our service provider's staging environment is unavailable and we aren’t notified. You can verify an outage by viewing the status pages below or try again when the service provider is back in service.

Reporting a problem

Before reporting a problem, search the vets-website and va.gov-team repositories to see if someone else has already reported it. If you don't find an existing issue related to the problem you’re seeing, we want to know about it. Please open a new GitHub issue based on the problem types listed below.

Help and feedback