Why3
What it is
Why3 is a platform for deductive program verification. It uses WhyML to express programs and specifications, then works with external automated or interactive theorem provers to discharge verification conditions. WhyML supports preconditions, postconditions, assertions, and loop invariants, alongside logical theories and data structures such as arrays, queues, and hash tables. External provers need to be installed and configured separately. Why3 can be extended with additional prover support and used as a software library through its OCaml API. Programs written in WhyML can be automatically extracted into correct-by-construction OCaml programs, and WhyML also serves as an intermediate language for verifying C, Java, Rust, and Ada programs. TryWhy3 offers a browser-based JavaScript version. Installation options include Opam, Docker, and compiling from source, with packages listed for Debian, Fedora, and Ubuntu. The graphical interface saves proof attempts and transformations in XML and can replay obsolete attempts. Why3 is free open source under GNU LGPL 2.1 with a special linking exception. Loop invariant inference remains a work in progress, with many features still very limited.
For and against
For
- Supports preconditions, postconditions, assertions, and loop invariants
- Can extract WhyML programs into OCaml
- Browser version runs as JavaScript
- Graphical interface saves and replays proof attempts
Against
- External provers require separate installation and configuration
- Loop invariant inference remains a work in progress
The verdict
Why3 offers a broad verification workflow, from specifying programs to working with external provers and extracting OCaml. Plan for separate prover setup, and note that loop invariant inference is still under development.
Who it suits
Why3 suits developers and verification researchers working with program specifications and external theorem provers. It also fits teams interested in extracting WhyML programs to OCaml or using Why3 through its API.
Plans and prices
Why3
GNU Lesser General Public License version 2.1 with a special linking exception
Read 10 Oct 2026 · why3.org
On the record
- Browser access
- TryWhy3 is a JavaScript version of the Why3 Verification Platform that runs in a browser.why3.org · read 9 Oct 2026
- Browser version
- TryWhy3 is a JavaScript-based version of the Why3 Verification Platform that can be used in a browser.why3.org · read 10 Oct 2026
- Code extraction
- WhyML programs can be automatically extracted into correct-by-construction OCaml programs.why3.org · read 9 Oct 2026
- Development
- Why3 is developed by the Inria Toccata team, a joint research team of Inria Saclay-Île-de-France, Université Paris-Saclay, and CNRS.why3.org · read 10 Oct 2026
- Downloads
- The site lists Debian, Fedora, and Ubuntu packages and links to source release 1.8.2.why3.org · read 10 Oct 2026
- Editor integrations
- Why3 distributions include configuration files for Emacs and Vim, plus shell completion files for bash and zsh.why3.org · read 9 Oct 2026
- Extensibility
- Why3 can be extended with support for new external provers and used as a software library through its API.why3.org · read 9 Oct 2026
- Extensibility and API
- Why3 can be extended with support for new theorem provers and used as a software library through an OCaml API.why3.org · read 10 Oct 2026
- Installation
- Why3 can be installed via Opam, run from a Docker image, or compiled from source.why3.org · read 9 Oct 2026
- Integrations
- The project lists EasyCrypt, Frama-C, and SPARK 2014 among projects that use Why3.why3.org · read 10 Oct 2026
- Language verification
- WhyML is used as an intermediate language for verification of Rust, OCaml, and Ada programs.why3.org · read 10 Oct 2026
- License
- TryWhy3 is distributed under the GNU Lesser General Public License version 2.1 with a special linking exception.why3.org · read 10 Oct 2026
- Notable limitation
- Loop invariant inference is described as work in progress, with many features still very limited.why3.org · read 9 Oct 2026
- Program extraction
- WhyML programs can be automatically extracted as correct-by-construction OCaml programs.why3.org · read 10 Oct 2026
- Proof sessions
- The graphical interface saves proof attempts and transformations in an XML file and can replay obsolete proof attempts.why3.org · read 9 Oct 2026
- Prover setup
- After installing a new prover, the site says to rerun `why3 config --detect`.why3.org · read 10 Oct 2026
- Prover support
- Why3 supports automated and interactive external provers, including Alt-Ergo, Z3, Rocq, PVS, and Isabelle/HOL.why3.org · read 10 Oct 2026
- Purpose
- Why3 is a platform for deductive program verification that uses WhyML and external theorem provers to discharge verification conditions.why3.org · read 10 Oct 2026
