Your testing sidekick, right inside Chrome. Analyze any web page, get test ideas tailored to it, run a checklist, document bugs and export everything in one click.
Analyze → Suggest → Test → Document → Export
Install · Features · How to use · Privacy · Development
Testing a new page usually starts the same way: figure out what kind of page it is, run the same basic checks, write down test ideas, keep notes, then copy everything into a report. QA Assistant does the routine part for you, so you can spend your time on actual exploratory testing.
- 🔍 Understands the page. Detects whether it's a login form, a checkout, a product page, a search page and more.
- ✅ Runs 16 automated checks. Broken links and images, console errors, mixed content, accessibility basics, layout overflow and others.
- 💡 Suggests test cases that fit the page type, sorted by priority.
- 📝 Keeps your test session. Checklists, test cases with steps and screenshots, notes and statuses.
- 🛠 Adds a DevTools panel for network, console and element investigation, plus a ready-made bug report.
- 📤 Exports to Excel, CSV, JSON or Markdown.
- 🔒 Keeps everything local. No accounts, no servers, no tracking. Secrets are masked before anything is saved or exported.
QA Assistant isn't on the Chrome Web Store yet, so you install it manually. It takes about a minute.
- Go to the Releases page and download
qa-assistant-vX.Y.Z.zip. - Unzip it. You'll get a folder with
manifest.jsoninside. - Open
chrome://extensionsin Chrome. - Turn on Developer mode (toggle in the top-right corner).
- Click Load unpacked and select the unzipped folder.
- Click the puzzle icon 🧩 in the toolbar and pin QA Assistant.
Keep the folder. Chrome loads the extension from that folder, so don't delete or move it after installing.
Requires Node.js 20 or newer.
git clone https://github.com/antonplotnikov/qa-assistant.git
cd qa-assistant
npm install
npm run buildThen follow steps 3–6 above and select the dist/ folder.
Download the new release (or git pull && npm run build), replace the folder contents, then click the ↻ reload button on the extension card in chrome://extensions.
Works in Chrome 116+ and other Chromium browsers (Edge, Brave, Arc, Opera).
- Open the website you want to test.
- Click the QA Assistant icon. A side panel opens.
- Click Analyze page.
- Review the results:
- Page type with confidence and reasons. You can override it if it's wrong.
- Checks: ✓ pass / ⚠ warning / ✕ fail. Use Highlight to see the affected elements on the page.
- Potential issues: log any of them as a failed test case in one click.
- Suggested tests: 🔴 High / 🟠 Medium / 🟢 Low.
- Work through the Checklist (Pass / Fail / Blocked / Not run) and write Test cases with steps, expected/actual results and screenshots.
- Open Export and download the session as XLSX, CSV, JSON or Markdown.
Tip: console errors are captured from page load. For tabs opened before you installed the extension, reload the page once.
Press F12 and open the QA Assistant tab:
| Tab | What it does |
|---|---|
| Network | Requests recorded while DevTools is open, with problem rows highlighted. Import a HAR file or export a masked one. |
| Console | Errors, warnings, unhandled rejections and failed resources, with repeats grouped and stack traces kept. |
| Element | Inspects the selected element: role, accessible name, size, attributes and issues like missing labels or tiny tap targets. Also available as a sidebar in the Elements panel. |
| Investigation | All findings in one place with filters. Pick the relevant ones, describe the bug, and copy or download a Markdown bug report, or add it as a failed test case. |
Page type detection
Login, registration, password reset, product, catalog, cart, checkout, search, dashboard, contact, form, article and general pages. Shows confidence, reasons and alternatives; the tester can override the type.
16 automated checks
Page load, HTTPS / mixed content, console errors, broken links, broken images, horizontal overflow, viewport/zoom, duplicate IDs, title, image alt, form labels, empty buttons, empty links, lang attribute, heading structure and positive tabindex. Each one reports affected elements and can highlight them on the page.
Suggested test cases & checklist
Templates per page type, grouped by priority. Conditional cases (for example "Remember me") appear only when that feature is detected on the page. Everything is editable.
Test case management
Title, priority, preconditions, ordered steps, expected and actual result, status, notes and screenshot evidence (capture the visible tab or upload an image). Sessions are grouped per page.
Export
XLSX, CSV, JSON or Markdown, for the current page or for all pages at once.
Languages
English (default) and Ukrainian.
- All data stays on your machine in
chrome.storage.local. Nothing is sent anywhere. - Secrets are masked as
[REDACTED]before they are stored or exported: tokens and keys in URLs,Authorization/Cookie/Set-Cookieheaders, Bearer tokens, JWTs and sensitive JSON fields. - Analysis doesn't change the site under test. Link checks are sent without cookies and skip logout, delete and unsubscribe URLs as well as one-time links (password reset, email verification, invites, magic links).
- Request and response bodies in the DevTools panel are off by default. When enabled, they are masked and truncated.
Masking is pattern-based. A secret with no recognizable name or format (for example a password typed into a free-text step) won't be detected, so review exports before sharing them.
Why does it need access to all sites?
The <all_urls> host permission is used to capture console errors from page start, check the status of cross-origin links, read the active tab's URL and take screenshots. Thanks to it, the broader tabs and activeTab permissions aren't requested.
| Script | Purpose |
|---|---|
npm run dev |
Rebuild on change (reload the extension in chrome://extensions after edits) |
npm run build |
Production build into dist/ |
npm test |
Unit tests (Vitest + jsdom) |
npm run test:e2e |
E2E smoke test of the built extension in Chromium (needs CHROME_PATH, see below) |
npm run typecheck |
TypeScript check |
npm run icons |
Regenerate PNG icons |
src/
shared/ domain types, message contracts, i18n (en is the source of truth; uk is type-checked against it)
core/ pure logic, no chrome.* APIs → unit-testable
page-type/ classifier: PageSignals → type + confidence + reasons
checks/ Check interface, DOM helpers, rules/ (one file per check), registry
insights/ potential issues (check failures + heuristics)
suggestions/ test-case & checklist templates (EN/UK) + generators
export/ exporter registry: csv, json, markdown, xlsx (lazy-loaded)
har/ HAR parsing / normalization / masking / export
findings/ network, console and element findings + filtering
element/ single-element inspection (DevTools $0)
security/ secret masking (URLs, headers, JSON, free text)
devtools/ DevTools page, panel and Elements sidebar (React); state/DevtoolsContext
content/ injected into pages: signal collection, analyzer API, highlighter,
console collectors (MAIN world hook → isolated world buffer)
background/ service worker: opens side panel, checks link HTTP statuses
infrastructure/ adapters: chrome.storage repositories, tabs/scripting/screenshot, downloads
sidepanel/ React UI: state/ (AppContext), components/, features/{analyze,checklist,test-cases,export}
Analyze flow: the side panel injects content/analyzer.js with chrome.scripting. The analyzer collects signals and runs the check registry against the live DOM. Link checking goes through the service worker, which can read real status codes without page CORS limits. The analyzer returns a serializable AnalysisResult; the panel stores it and builds suggestions in the current language.
Secret masking (core/security) runs at three points:
- inside the page, before the analysis result (console messages, stack traces, link details, page URL) leaves it;
- in the console buffer itself, as entries arrive;
- again right before every export (
exportSessions), which also covers text typed by the tester and data saved by older versions.
DevTools bodies are masked by format (JSON by key at any depth, form and multipart by field name, other text by pattern) and cut to 20 000 characters. Values of Authorization, Cookie, Set-Cookie, X-Api-Key, X-CSRF-Token and similar headers are always replaced, in any case.
| Add… | Where |
|---|---|
| A check | New file in core/checks/rules/, register in core/checks/registry.ts, add checks.<id>.* keys to en.ts + uk.ts |
| A page type | PAGE_TYPES in shared/types/page.ts, a rule in classifier.ts, templates in core/suggestions/*, i18n label |
| An export format | Implement Exporter in core/export/, register in core/export/index.ts |
| An integration (Jira, TestRail…) | New adapter under infrastructure/ consuming Session objects, the same way the exporters do |
tests/e2e/smoke.mjs starts a local test site (with fake secrets, duplicate console errors, broken and one-time links), loads dist/ into a throwaway Chromium profile and checks injection, console capture, link checking through the service worker, masking, the side panel UI and chrome.storage.
Headless Chromium can't open DevTools, so the DevTools panel is tested in an extension tab with a test double of chrome.devtools (eval is forwarded to the inspected tab through chrome.scripting). Branded Google Chrome ignores --load-extension; use Chromium or Chrome for Testing, e.g. Playwright's:
CHROME_PATH="$HOME/Library/Caches/ms-playwright/chromium-<ver>/chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing" npm run test:e2eNot covered (manual): opening the side panel from the toolbar icon, XLSX/CSV/JSON downloads (Markdown download is covered), file:// pages, and everything inside real DevTools (panel and sidebar registration, $0, live chrome.devtools.network events, clipboard in the DevTools frame).
- Suggested tests and checklist items are generated in the language active at that moment. After that they're ordinary editable text.
- Up to 60 links are checked per analysis, same-origin first.
- Restricted pages (
chrome://, the Chrome Web Store) can't be analyzed.
Issues and pull requests are welcome. Before opening a PR, please run npm run typecheck && npm test.
MIT © Anton Plotnikov