Types of hackers: white hat, black hat, grey hat and more
In short: Hackers are often grouped by "hat" colour. White hats work with permission to find and fix weaknesses, black hats break in for gain or harm, and grey hats act without permission but without clear criminal intent. Permission, not skill, is what makes hacking ethical and legal.
What "hacker" means
Originally, a hacker was simply someone who enjoyed understanding systems deeply and making them do unexpected things. The news later used the word for criminals who break into computers. In security work, both meanings survive, so people add a label to show intent. The most common labels borrow from old western films, where heroes wore white hats and villains wore black ones.
The three hats
- White hat (ethical hacker): tests systems with the owner's written permission, stays in scope and reports findings privately so they can be fixed. Penetration testers, red team members and many security researchers work this way.
- Black hat: breaks in without permission to steal, extort, spy or disrupt. This is crime in almost every country.
- Grey hat: probes systems without permission but claims good intentions, for example by telling the owner about a flaw afterwards, sometimes while asking for payment. Even when no harm is meant, unauthorised access is usually still illegal, and asking for money can look like extortion.
The grey hat label is a warning rather than a career path. If you find a problem by accident, report it through the organisation's vulnerability disclosure policy or a national CERT, and do not explore further. See permission, scope and law for the legal background.
Other labels you will hear
| Label | Meaning |
|---|---|
| Script kiddie | An unskilled attacker who runs tools written by others without understanding them. Still dangerous against unpatched systems. |
| Hacktivist | Attacks to promote a political or social cause, often by defacing websites, leaking data or denial of service. |
| State-sponsored hacker | Works for or with a government, usually for espionage or disruption. See threat actors. |
| Bug bounty hunter | A white hat who tests systems under a published bounty programme and is paid for valid findings. |
| Red team and blue team | Attackers and defenders in an authorised exercise. Purple teaming means they work together openly. |
Some writers also use "green hat" for beginners who are learning, or "red hat" for people who attack attackers. These are informal terms and not used consistently, so avoid relying on them in exams.
Why the labels matter at work
Labels affect how organisations respond. A report from a known researcher through a disclosure programme is handled as a helpful tip and fixed. Unexplained scanning from an unknown source is handled as a possible attack. If you work in security, behave so there is never any doubt which group you belong to: get permission first, keep records of it, and stay inside the scope you were given. Employers and clients check this, and a single unauthorised test can end a career before it starts.
Real-world example: a student finds a flaw
A college student notices that changing a number in the address bar of the college's results portal shows another student's grades. She stops immediately, takes one screenshot of her own record and the changed address, and emails the IT service desk using the address in the college's disclosure policy. She does not look at other records or share the screenshot. The college fixes the access check within a week and thanks her. Had she downloaded other students' results "to prove it", the same discovery could have led to disciplinary or legal action.
Practice
What single factor separates a white hat from a black hat?
Why is grey hat hacking risky even if no damage is done?
Is a bug bounty hunter a white hat?
Key takeaways
- Hat colours describe intent and permission, not skill.
- White hats test with written permission and report privately.
- Black hats attack for gain or harm; grey hats act without permission.
- Other labels include script kiddies, hacktivists, state hackers and bug bounty hunters.
- If you stumble on a flaw, stop and report it through the proper channel.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.