How many test cases should a single user story have?

My lead reviewed my work and said I had "too many" test cases for one story — I wrote 34 for a login form. Another colleague says that is thorough.

Is there a sensible number, or is the question itself wrong?

The question is the wrong shape — count is an output, not a target. What matters is coverage of risk.

34 cases for a login form is not automatically wrong, but it often signals one of two smells:

• Combinatorial explosion — writing every permutation of valid/invalid username × password instead of using equivalence partitioning and boundary values, which usually collapses 34 into about 10.
• Cases that are really steps — "enter username", "enter password", "click submit" are steps within one case, not three cases.

Try re-deriving them from partitions and see what survives. If you still land near 34 and each maps to a distinct risk, defend it.