Say the word “hacker” and most people picture a hoodie in a dark room. That image is mostly wrong. Hackers are sorted into different types based on what they do and why, not what they wear.
There are six main types of hackers, split by a color-coded “hat” system: white hat (ethical, authorized), black hat (criminal, unauthorized), grey hat (unauthorized but not malicious), red hat (vigilantes who go after black hats), blue hat (outside testers hired before a product launch), and green hat (beginners still learning the craft). The hat color describes intent and legal standing. It says nothing about raw skill.
Below, we cover what each hat actually does, real examples of people in each category, how the law treats them differently, and where newer categories like script kiddies and state-sponsored hackers fit in. You’ll see this topic called by different types of hackers, kinds of hackers, classes of hackers, categories of hackers, or simply hacker types, and whichever type of hackers list brought you here, the six hacker hat colors below (sometimes just called hacker hats) cover the core ones.
Where the “Hacker Hat” Idea Comes From
The hat system borrows from old Western films, where the hero wore a white hat and the villain wore a black one. Security researchers picked up the metaphor decades ago, and it stuck because it’s an easy shorthand for intent: white for good, black for bad, and everything else somewhere in between.
The 6 Types of Hackers at a Glance
| Hat color | Legal? | Motivation | Real-world example |
|---|---|---|---|
| White hat | Yes, with permission | Find and fix flaws | Paid penetration testers |
| Black hat | No | Money, damage, data theft | Ransomware gangs |
| Grey hat | Usually not, but not malicious | Curiosity, recognition | Unpaid bug hunters who alert companies |
| Red hat | Legally gray, often aggressive | Stop black hats directly | Vigilante counter-hackers |
| Blue hat | Yes, contracted | Test a product before release | External security consultants |
| Green hat | Neither, still learning | Build skills | Hacking students and hobbyists |
White Hat Hackers
White hat hackers, also called ethical hackers, break into systems with the owner’s written permission to find weaknesses before criminals do. Companies hire them directly, work with them through bug bounty programs, or bring them in as independent penetration testers.
A white hat operation always starts with a signed agreement, often called a scope of work, spelling out exactly what can be tested and what’s off-limits.
Without that permission, the exact same actions would be illegal. The technique doesn’t change, only the authorization does.
White hat hacking blends real hat coding and technical skills with something just as important: strict rules of engagement and legal sign-off before anything happens. Definition of white hat hacker, distilled to one line: authorized access, good intent, always with consent.
Famous White Hat Hackers
- Kevin Mitnick spent years as one of the FBI’s most-wanted hackers before serving prison time and turning his skills into a legitimate cybersecurity career, eventually running his own security firm.
- Charlie Miller is another well-known name. He found and reported serious vulnerabilities in Apple products and worked directly with the company to fix them.
Also read: Is Spokeo Safe?
Black Hat Hackers
Someone who breaks into systems without permission, for personal gain or to cause harm. Black hat hacker meaning, put simply, is the opposite of white hat. No authorization, no consent, and usually a criminal motive behind it. The definition of a black hat hacker, in every serious cybersecurity source, comes back to the same core idea.
Motivations of black hat hackers typically include:
- Financial gain: Stealing credit card numbers, bank details, or deploying ransomware for a payout.
- Data theft: Stealing sensitive information to sell on the dark web or use for identity theft.
- Disruption: Taking down websites or services, sometimes through DDoS attacks.
- Espionage: Stealing trade secrets or classified information for a competitor or foreign government.
Common black hat techniques include phishing emails, malware, exploiting unpatched security vulnerabilities, and social engineering. Tricking a real person into handing over access instead of breaking in technically. To define a black hat hacker in one line: unauthorized access, malicious or selfish intent, no permission at all.
Grey Hat Hackers
Grey hat hackers (also spelled greyhat hacker, and sometimes just called grey hatters) sit between white and black. Grey hat hacking is accessing a system without permission, technically illegal, but without the intent to steal, damage, or profit from it.
A typical grey hat scenario: someone finds a security flaw in a company’s website without being asked to look for one, then reports it to the company, sometimes expecting a reward or public credit in return.
They didn’t have authorization, so it’s not clean white hat work. But they didn’t try to cause harm either, so it’s not black hat behavior. That legal grey area is exactly where the name comes from, and it’s also why companies vary widely in how they respond. Some thank a grey hat, others report them to the police.
Red Hat Hackers
Red hat hackers are the vigilantes of the hacking world. A red hat hacker is someone who actively goes after black hat hackers using aggressive, often equally illegal methods, infecting a criminal’s system with malware, knocking their servers offline, or destroying the tools they use to attack others.
Red hat hacking isn’t about defense, the way white hat work is. It’s direct retaliation. It puts the red hackers in a strange legal position: they’re targeting criminals, but their own methods usually break the same laws the criminals broke.
Blue Hat Hackers
Blue hat hacker is a term with two different meanings, and mixing them up is one of the most common mistakes in this topic.
- The professional meaning, which comes from Microsoft’s own “BlueHat” security conferences: an outside security expert hired to test software for bugs before it ships. This is a contracted, legal, white-hat-style job, just done by someone outside the company.
- The older, informal meaning: an amateur hacker who attacks a system purely out of personal revenge, with no real technical ambition beyond getting back at someone.
Green Hat hackers
Green hat hackers are newcomers to the field. They lack deep technical skills right now, but they’re actively trying to learn, following tutorials, joining hacking forums, and asking questions from more experienced hackers. Green hat hackers aren’t the same as script kiddies (more on that below); a green hat genuinely wants to understand how the attack works, not just run someone else’s tool.
Beyond the 6 Hats: Other Hacker Categories Worth Knowing
The color system covers intent well, but a few other labels come up constantly in cybersecurity and are worth knowing:
- Script kiddies: Inexperienced hackers who run tools and scripts built by someone else, without understanding how they work underneath.
- State-sponsored hackers: Hackers funded and directed by a government, usually targeting other governments, critical infrastructure, or rival nations for espionage or sabotage.
- Hacktivists: Hackers motivated by a political or social cause rather than money, using attacks to make a statement or expose an organization.
- Insider threats: Employees or contractors who misuse the access they were already legitimately given, whether out of revenge, greed, or coercion.
These categories describe a hacker’s role or funding source rather than a hat color, and a single person can technically fit into both systems at once, like a state-sponsored hacker, for instance, could still be operating with black hat methods.
Ethical Considerations White-Hat vs Black-Hat Hacking Cybersecurity
The single legal line that separates every “good” hacker from every “bad” one is consent. In most countries, laws like the U.S. Computer Fraud and Abuse Act make unauthorized access to a computer system illegal, regardless of intent.
That means a grey hat who means well, and a black hat who means harm, can both be prosecuted under the same law. The harmful intent usually affects the severity of the sentence, not whether a crime occurred at all.
This is exactly why legitimate white hat work always starts with a signed contract. Good intentions are not a legal defense on their own.
Profile of a Hacker: What Skills Does It Actually Take?
Skilled hackers, regardless of hat color, tend to share a similar profile: strong knowledge of networks and operating systems, comfort reading and writing code, and a genuine curiosity about how systems break.
What separates a professional white hat from the rest is everything around that skill set, like legal training, a code of ethics, and often a recognized certification like CEH (Certified Ethical Hacker) or OSCP (Offensive Security Certified Professional).
Frequently asked questions
What’s the difference between white hat and black hat hacking?
Permission and intent. White hat hackers have explicit authorization and aim to help. Black hat hackers have neither.
Is grey hat hacking illegal?
Yes, because it happens without permission, even when the hacker’s intentions are good, and no harm is done.
What are the 6 types of hackers?
White hat, black hat, grey hat, red hat, blue hat, and green hat, categorized by intent and legal authorization rather than skill level.
The Bottom Line
Six hat colors, one real distinction: permission. White and blue hats have it. Black, grey, and red hats don’t, even when a grey or red hat’s goal is arguably a good one. Green hats haven’t picked a side yet; they’re still learning the craft that every other hat depends on.