diff --git a/{{cookiecutter.app_name}}/tests/conftest.py b/{{cookiecutter.app_name}}/tests/conftest.py
index 42774cc..2c45e15 100644
--- a/{{cookiecutter.app_name}}/tests/conftest.py
+++ b/{{cookiecutter.app_name}}/tests/conftest.py
@@ -9,6 +9,7 @@ from {{ cookiecutter.app_name }}.settings import TestConfig
 from {{cookiecutter.app_name}}.app import create_app
 from {{cookiecutter.app_name}}.database import db as _db
 
+from .factories import UserFactory
 
 @pytest.yield_fixture(scope='function')
 def app():
@@ -34,3 +35,8 @@ def db(app):
     yield _db
 
     _db.drop_all()
+
+
+@pytest.fixture
+def user(db):
+    return UserFactory()
diff --git a/{{cookiecutter.app_name}}/tests/test_forms.py b/{{cookiecutter.app_name}}/tests/test_forms.py
new file mode 100644
index 0000000..45bf33c
--- /dev/null
+++ b/{{cookiecutter.app_name}}/tests/test_forms.py
@@ -0,0 +1,62 @@
+# -*- coding: utf-8 -*-
+import pytest
+
+from {{cookiecutter.app_name}}.public.forms import LoginForm
+from {{cookiecutter.app_name}}.user.forms import RegisterForm
+from .factories import UserFactory
+
+class TestRegisterForm:
+
+    def test_validate_user_already_registered(self, user):
+        # Enters username that is already registered
+        form = RegisterForm(username=user.username, email='foo@bar.com',
+            password='example', confirm='example')
+
+        assert form.validate() is False
+        assert 'Username already registered' in form.username.errors
+
+    def test_validate_email_already_registered(self, user):
+        # enters email that is already registered
+        form = RegisterForm(username='unique', email=user.email,
+            password='example', confirm='example')
+
+        assert form.validate() is False
+        assert 'Email already registered' in form.email.errors
+
+    def test_validate_success(self, db):
+        form = RegisterForm(username='newusername', email='new@test.test',
+            password='example', confirm='example')
+        assert form.validate() is True
+
+
+class TestLoginForm:
+
+    def test_validate_success(self, user):
+        user.set_password('example')
+        user.save()
+        form = LoginForm(username=user.username, password='example')
+        assert form.validate() is True
+        assert form.user == user
+
+    def test_validate_unknown_username(self, db):
+        form = LoginForm(username='unknown', password='example')
+        assert form.validate() is False
+        assert 'Unknown username' in form.username.errors
+        assert form.user is None
+
+    def test_validate_invalid_password(self, user):
+        user.set_password('example')
+        user.save()
+        form = LoginForm(username=user.username, password='wrongpassword')
+        assert form.validate() is False
+        assert 'Invalid password' in form.password.errors
+
+    def test_validate_inactive_user(self, user):
+        user.active = False
+        user.set_password('example')
+        user.save()
+        # Correct username and password, but user is not activated
+        form = LoginForm(username=user.username, password='example')
+        assert form.validate() is False
+        assert 'User not activated' in form.username.errors
+
diff --git a/{{cookiecutter.app_name}}/{{cookiecutter.app_name}}/settings.py b/{{cookiecutter.app_name}}/{{cookiecutter.app_name}}/settings.py
index 03efe74..650a5dc 100644
--- a/{{cookiecutter.app_name}}/{{cookiecutter.app_name}}/settings.py
+++ b/{{cookiecutter.app_name}}/{{cookiecutter.app_name}}/settings.py
@@ -39,3 +39,4 @@ class TestConfig(Config):
     DEBUG = True
     SQLALCHEMY_DATABASE_URI = 'sqlite://'
     BCRYPT_LOG_ROUNDS = 1  # For faster tests
+    WTF_CSRF_ENABLED = False  # Allows form testing
diff --git a/{{cookiecutter.app_name}}/{{cookiecutter.app_name}}/user/forms.py b/{{cookiecutter.app_name}}/{{cookiecutter.app_name}}/user/forms.py
index 817f2ed..165e81f 100644
--- a/{{cookiecutter.app_name}}/{{cookiecutter.app_name}}/user/forms.py
+++ b/{{cookiecutter.app_name}}/{{cookiecutter.app_name}}/user/forms.py
@@ -30,6 +30,4 @@ class RegisterForm(Form):
         if user:
             self.email.errors.append("Email already registered")
             return False
-
-        self.user = user
         return True