Black, White and Gray Box Testing
Three people test Basketly's SAVE10 coupon. One only uses the website. One reads the discount code line by line. One uses the website but also peeks into the database to set up a tricky coupon. All three are testing the same feature, from three different positions: outside, inside, and in between.
The rule
Black box sees behaviour, white box sees code, gray box sees a little of both.
- Black box testing: you know what the feature should do, but not how it is built. You choose inputs, observe outputs and compare with an oracle. It tests the product the way a user meets it.
- White box testing: you can see the code and design tests from its structure, aiming to run every branch and path. Developers often do this through unit tests.
- Gray box testing: you test from the outside, but inside knowledge, such as the database schema, the API or the architecture, helps you choose sharper tests and set up hard situations.
Here is a simplified version of the coupon code a white box tester might read:
function applyCoupon(cart, coupon) {
if (coupon.expired) return cart.subtotal;
if (cart.subtotal >= 500) return cart.subtotal * 0.9;
return cart.subtotal;
}A black box tester might never think of an expired coupon. A white box tester sees the first if and makes sure a test reaches it.
The shortcut
Ask "What can I see?" Only the screen and the requirements: black box. The source code: white box. The screen plus some internals such as the database, logs or API: gray box.
Black box
Through the website, apply SAVE10 to a ₹499 cart and a ₹500 cart. Expect ₹499 and ₹450.
None of the three is "best". Strong teams mix them: white box for coverage of the code, black box for realism, gray box for hard-to-reach setups.
Drills
Answer fast — trust the rule.
A tester writes tests to make sure every if branch in the discount function runs. Which approach is this?
A tester uses only the website and the written requirements. Which approach?
A tester changes a row in the test database, then checks the result through the app. Which approach?
What is a typical weakness of pure black box testing?
Remember
- Black box sees behaviour, white box sees code, gray box sees a little of both.
- Ask "What can I see?" to name the approach.
- Mix them: white box for coverage, black box for realism, gray box for hard setups.