Black, White & Gray Box Testing + Code Coverage Explained

What is White Box Testing?

Testing the application using the internal source code is called White Box Testing.

It is mostly done by developers (unit tests), but testers use white box techniques too — for example in API and integration tests, code reviews, and when SDETs read the code to design tests.

Types of White Box Testing include:

• Loop Testing
• Conditional Testing
• Path Testing

What is Black Box Testing?

Testing the functionality or GUI of an application without knowledge of the internal source code is called Black Box Testing.

There is no need for internal source code.

It is done by the testing team.

Types of Black Box Testing include:

• System Testing
• Acceptance Testing

What is Gray Box Testing?

Gray Box Testing is a software testing type in which the tester has only a partial understanding of the internal structure of the application.

The tester has limited information about the internal functionality and code.

The purpose is to search for and identify defects caused by:

• Improper code structure.
• Improper application use.

Black Box vs White Box vs Gray Box Testing

Black Box Testing

Knowledge of Code

• None

Performed By

• Testing Team

Focus

• Functionality / GUI

Example Types

• System Testing
• Acceptance Testing

White Box Testing

Knowledge of Code

• Full internal source code

Performed By

• Developer

Focus

• Internal logic (loops, conditions, paths)

Example Types

• Loop Testing
• Conditional Testing
• Path Testing

Gray Box Testing

Knowledge of Code

• Partial

Performed By

• Tester with limited code information

Focus

• Defects caused by improper code structure or improper application use

Verification vs Validation

Verification

Verification is done on documents.

It checks whether the product/system we are building is right.

It is static testing.

It checks whether we are following the right process.

The code is not executed.

It is performed using the software documentation.

Example

Google Maps — before starting, check whether it shows the correct path.

That is, checking whether it is right before we begin.

Validation

Validation is done on the software.

It checks whether the product/system we have developed is right.

It is dynamic testing.

It checks the software according to customer requirements.

Example

You start the car and go with the help of the map.

Here, checking whether the suggested route is actually right is validation.

Verification vs Validation

Verification

Done On

• Documents

Question

• Are we building the product right?

Type

• Static Testing

Code Executed?

• No

Validation

Done On

• Software

Question

• Have we built the right product?

Type

• Dynamic Testing

Code Executed?

• Yes

Code Coverage

Code coverage measures the amount of software (code) that is tested.

It falls under White Box Testing because it involves the code.

It helps us find the gap by identifying how much of the code is not tested.

When we find the gap, we increase our test coverage by giving more inputs so that more code is tested.

Path Coverage

We measure the number of paths in the program, or how many paths will be executed.

Path coverage is a White Box Testing technique.

The objective is to execute all possible independent paths in the program at least once.

It helps identify untested execution paths in the application.

Cyclomatic Complexity

Cyclomatic complexity is a testing metric used to measure the complexity of a software program.

It is a quantitative measure of the independent paths in the source code.

It can be calculated:

• Using control flow graphs.
• With respect to functions.
• Modules.
• Methods.
• Classes within a program.

It helps determine the minimum number of test cases required to achieve complete path coverage.

Higher cyclomatic complexity indicates more complex code and requires more test cases.

Try It: 100% Statement Coverage Isn't 100% Tested

Here is a small discount rule — members get 10% off, orders over 2,000 get another 5%:

function discount(total, isMember) {
  let rate = 0;
  if (isMember) rate = 10;
  if (total > 2000) rate += 5;
  return total - (total * rate) / 100;
}

We measured coverage with Istanbul (nyc), the standard JavaScript coverage tool, first with one test and then with four:

One test executed every line, so statement coverage was already 100% — yet it never checked a non-member or a small order. Branch coverage exposed the gap. Two more lessons:

• Tools measure differently. Node's built-in V8 coverage reported 100% branches even for the single test, because it doesn't count an if without an else as two branches. Know what your tool counts before trusting a number.
• Cyclomatic complexity of this function is 3 (two decisions + 1), so 3 tests are the minimum to cover the independent paths; all combinations of the two conditions take 4. Coverage tells you what code ran, not whether the assertions were right — a test with no assertions still produces coverage.

Practise choosing black box and white box test techniques for realistic situations in the Manual Testing Simulator. Designing the black box side: Test Design Techniques.

📚 Official documentation: ISTQB Glossary of testing terms

FAQs

1. What is the difference between Black Box Testing and White Box Testing?

Black Box Testing checks functionality or GUI without knowledge of the internal code and is done by the testing team.

White Box Testing uses the internal source code and is done by developers.

2. What is Gray Box Testing?

Testing with only a partial understanding of the application's internal structure.

It is aimed at finding defects caused by improper code structure or improper use of the application.

3. What is the difference between Verification and Validation?

Verification

Done on documents (Static Testing) to check whether we are building the product right.

Validation

Done on the software (Dynamic Testing) to check whether we built the right product according to customer requirements.

4. What is Code Coverage?

A White Box measure of how much of the code has been tested.

It reveals untested code so more inputs can be added to increase coverage.

5. What is Path Coverage?

A White Box technique whose objective is to execute all possible independent paths in the program at least once.

It helps identify untested execution paths.

6. What is Cyclomatic Complexity?

A metric measuring the number of independent paths in the source code.

It helps determine the minimum number of test cases needed for complete path coverage.

Higher complexity means more test cases.

7. Which testing types fall under Black Box Testing and White Box Testing?

Black Box Testing

• System Testing
• Acceptance Testing

White Box Testing

• Loop Testing
• Conditional Testing
• Path Testing