Black box, grey box, white box: which one to choose

The names describe how much the tester knows before they start.

Black box

No inside information, like an outsider. It shows what is visible from outside, but spends time on discovery and may miss what sits behind a login.

Grey box

The tester receives accounts for each user role and some documentation. This is the best value for most web applications and APIs: time goes into testing what matters, such as whether one user can see another's data.

White box

Full access to source code and configuration. It finds the most, including flaws that are hard to reach from outside, but takes the most effort.

How to choose

• A first test of a product with logins: start with grey box.
• A view of what the internet sees: black box on the external perimeter.
• A critical component or a test before a major release: add white box.