Why3
Why3 is a platform for deductive program verification.
What Why3 is
Why3 is a platform for deductive program verification. It uses WhyML specifications and programs with external automated or interactive theorem provers to discharge verification conditions; those provers must be installed and configured separately. WhyML supports preconditions, postconditions, assertions, and loop invariants, and the standard library includes logical theories and data structures such as arrays, queues, and hash tables. WhyML programs can be extracted automatically into correct-by-construction OCaml programs, and WhyML is also used as an intermediate language for verifying C, Java, Rust, and Ada. TryWhy3 provides a JavaScript version that runs in a browser. The graphical interface saves proof attempts and transformations in XML and can replay obsolete attempts. Why3 can be extended with additional prover support and used as a software library through its OCaml API. It is free and open source under GNU LGPL 2.1 with a special linking exception. Loop invariant inference is still a work in progress, with many features described as very limited.
Good
- WhyML supports preconditions, postconditions, and assertions.
- Programs can be extracted into OCaml automatically.
- TryWhy3 runs in a browser.
- Proof attempts can be saved and replayed.
Watch out
- External theorem provers require separate installation and setup.
- Loop invariant inference remains a work in progress.
- Many loop-invariant features are very limited.
Who it suits
Why3 suits developers and researchers working on deductive verification with contracts and WhyML. It may also fit users who need to connect external provers or use its OCaml API.
Verdict
Why3 offers a free, open-source environment for deductive verification, with browser access and extensible prover support. Factor in the separate prover setup and limits around loop invariant inference.
Plans and prices
From Why3's own pricing page, checked 10 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Why3 | Free | GNU Lesser General Public License version 2.1 with a special linking exception |
The facts
Each one read from Why3's own pages, with the date it was checked.
Where it runs
- Browser access
- TryWhy3 is a JavaScript version of the Why3 Verification Platform that runs in a browser.checked 9 Oct 2026
- Browser version
- TryWhy3 is a JavaScript-based version of the Why3 Verification Platform that can be used in a browser.checked 10 Oct 2026
What it does
- Code extraction
- WhyML programs can be automatically extracted into correct-by-construction OCaml programs.checked 9 Oct 2026
- Development
- Why3 is developed by the Inria Toccata team, a joint research team of Inria Saclay-Île-de-France, Université Paris-Saclay, and CNRS.checked 10 Oct 2026
- Downloads
- The site lists Debian, Fedora, and Ubuntu packages and links to source release 1.8.2.checked 10 Oct 2026
- Editor integrations
- Why3 distributions include configuration files for Emacs and Vim, plus shell completion files for bash and zsh.checked 9 Oct 2026
- Extensibility
- Why3 can be extended with support for new external provers and used as a software library through its API.checked 9 Oct 2026
- Extensibility and API
- Why3 can be extended with support for new theorem provers and used as a software library through an OCaml API.checked 10 Oct 2026
- Installation
- Why3 can be installed via Opam, run from a Docker image, or compiled from source.checked 9 Oct 2026
- Integrations
- The project lists EasyCrypt, Frama-C, and SPARK 2014 among projects that use Why3.checked 10 Oct 2026
- Language verification
- WhyML is used as an intermediate language for verification of Rust, OCaml, and Ada programs.checked 10 Oct 2026
- License
- TryWhy3 is distributed under the GNU Lesser General Public License version 2.1 with a special linking exception.checked 10 Oct 2026
- Notable limitation
- Loop invariant inference is described as work in progress, with many features still very limited.checked 9 Oct 2026
- Program extraction
- WhyML programs can be automatically extracted as correct-by-construction OCaml programs.checked 10 Oct 2026
- Proof sessions
- The graphical interface saves proof attempts and transformations in an XML file and can replay obsolete proof attempts.checked 9 Oct 2026
- Prover setup
- After installing a new prover, the site says to rerun `why3 config --detect`.checked 10 Oct 2026
- Prover support
- Why3 supports automated and interactive external provers, including Alt-Ergo, Z3, Rocq, PVS, and Isabelle/HOL.checked 10 Oct 2026
- Purpose
- Why3 is a platform for deductive program verification that uses WhyML and external theorem provers to discharge verification conditions.checked 10 Oct 2026
- Standard library
- Why3 includes logical theories and programming data structures such as arrays, queues, and hash tables.checked 10 Oct 2026
- Support
- The project provides a user mailing list, a Zulip chat, and a bug tracking system.checked 10 Oct 2026
- WhyML
- WhyML supports specifications and programs with preconditions, postconditions, assertions, and loop invariants.checked 9 Oct 2026
