SoftwareTestPilot
Software Testing FundamentalsPublished: 10 min read

Exploratory Testing Charter Template — With 8 Examples (2026)

The exploratory testing charter template used by session-based teams at Microsoft and Shopify. Includes 8 real charters, a 90-minute session log format, and how to report findings to product.

Avinash K
Founder & QA Engineer at SoftwareTestPilot
Share:XLinkedInWhatsApp
Exploratory testing charter template — session-based test management format.
Exploratory testing charter template — session-based test management format.

Last updated 2026-07-20 · 10 min read · By Avinash K

Scripted tests cover what you already know can fail; exploratory testing finds the unknowns. James Bach's session-based test management (SBTM) formalizes it: a charter, a 90-minute session, a debrief. This guide gives you the exact charter template we use plus 8 charters you can lift for common features.

Key takeaways

  • The 4-line charter format that fits on a Post-it.
  • A 90-minute session log template with time-boxing.
  • 8 ready-to-run charters for login, search, checkout, and API flows.
  • How to fold findings back into automated regression.

1. The 4-line charter format

EXPLORE:   {area or feature}
WITH:      {resources, personas, data}
TO DISCOVER:  {information the team needs}
TIME-BOX:  60 or 90 minutes

Example: Explore the coupon field WITH expired, malformed, and unicode coupon codes TO DISCOVER validation and error-handling gaps. Time-box 60 min.

2. Session log — the SBTM template

Charter:     {above}
Tester:      Priyanka G.
Duration:    60 min (setup 8, testing 42, bug filing 10)
Coverage:    coupon field, cart totals, order summary
Bugs:        QA-2411, QA-2413
Issues:      staging DB slow (blocked 2 checks)
Notes:       unicode coupons cause 500 in v2 API, not v1

3. Eight ready-to-run charters

  1. Login — WITH SSO, magic-link, expired sessions TO DISCOVER auth race conditions.
  2. Search — WITH empty, unicode, 5k-char queries TO DISCOVER escaping and pagination bugs.
  3. Checkout — WITH declined cards, 3DS, zero-total orders TO DISCOVER payment state machine issues.
  4. Signup — WITH disposable emails, plus-addresses, and Cyrillic names TO DISCOVER validation gaps.
  5. Upload — WITH 5GB, 0-byte, and executable files TO DISCOVER size and MIME checks.
  6. API auth — WITH expired JWTs, missing scopes, replay tokens TO DISCOVER 401/403 consistency.
  7. Notifications — WITH timezones, DST, unsubscribed users TO DISCOVER delivery correctness.
  8. Admin panel — WITH role escalation attempts TO DISCOVER authorization holes (see our security testing guide).

4. Feeding findings back into regression

Every reproducible bug from an exploratory session gets a matching automated test in your Playwright or Selenium suite so it never regresses. Cross-reference with your regression strategy. The canonical SBTM paper is Bach & Bolton's SBTM primer.

Frequently asked questions

1.How long should an exploratory session be?
60 or 90 minutes. Shorter than 45 rarely uncovers deep bugs; longer than 120 leads to fatigue and shallow coverage.
2.Can exploratory testing replace scripted regression?
No — they are complementary. Regression protects against known failures; exploratory finds unknown ones.
3.Who writes the charters?
The tester leading the session, reviewed by a peer or lead. Product-driven charters (from support tickets) work well too.
4.Do I need SBTM tooling or is a spreadsheet enough?
A shared doc or Notion database is enough for teams under 10. Larger orgs use Xray, TestRail, or Rapid Reporter.