Read the case
Look for explicit permission, agreed boundaries, harmful actions and what happened after a vulnerability was found.
HAT
TRICK
PERMISSION PROTOCOL
READ THE EVIDENCE. CLASSIFY THE CONDUCT.
THE ETHICAL GAUNTLETLIVE CLASSIFICATION ARENAPERMISSION
PERMISSION
CHANGES EVERYTHING.
Judge the evidence, then place the right hat. The opening cases teach the core trio. Community labels enter as the pace increases.
Touch, mouse, drag-and-drop and keyboard supported. No account required.THE COLOUR IS A CLUE.
THE CONDUCT IS THE ANSWER.
Each short case gives you evidence about authorisation, scope, intent, impact and disclosure. Classify the action - not the character’s appearance or claim.
Place the hat
Tap, click or drag a labelled hat onto the contestant. Keyboard players can use number keys 1 to 9.
Review the ruling
Correct answers add time and build the streak. A mistake costs time but explains the decisive evidence.
Share your rank
Finish as a Packet Rookie, Scope Keeper or Grandmaster Auditor and share a spoiler-free result.
WHAT DO HACKER
HAT COLOURS MEAN?
Hacker “hat” colours are informal shorthand for different security behaviours and roles. The core white, black and grey labels are widely recognised. Other colours are community terminology and can mean different things in different sources.
Authorised and defensive
Works with permission, follows scope, minimises harm and reports findings through an agreed process. A penetration tester, bug bounty researcher or internal security specialist can act as a white hat only when the activity is authorised.
Malicious or criminal
Steals, extorts, sabotages, disrupts or gains unauthorised access for harmful ends. Ransomware deployment, credential theft and selling stolen data are clear examples.
Unauthorised, without the usual malicious aim
May find or demonstrate a weakness without permission and then disclose it. A claimed good motive does not make unauthorised access safe, lawful or acceptable.
Useful vocabulary - never a substitute for facts
Definitions vary. Hat Trick uses these common interpretations as bonus rounds and always tells you when context is insufficient.
- RED
- Vigilante who attacks malicious actors; “good” intent can still cause unlawful harm.
- BLUE
- External specialist hired to test before launch; some communities use blue differently.
- GREEN
- Beginner actively learning, sometimes using tools without understanding the consequences.
- PURPLE
- Defender blending offensive testing and defensive engineering inside an organisation.
- YELLOW
- Secure coder or application-security builder; a less standard community label.
- UNKNOWN
- Not enough evidence. The correct choice when permission, conduct or impact is missing.
THE PERMISSION PROTOCOLFIVE QUESTIONS BEAT
FIVE QUESTIONS BEAT
ONE COLOUR.
Real cyber ethics cannot be decided by a nickname. Use the same five-question model at work, in training and when reading security news.
- 01PERMISSIONWas the activity clearly authorised?
- 02SCOPEDid it stay inside the agreed systems and methods?
- 03INTENTWas the goal defensive, curious, retaliatory or harmful?
- 04IMPACTWas data exposed, service disrupted or a person put at risk?
- 05DISCLOSUREWas the finding reported responsibly through a safe channel?
QUICK ANSWERS.
What is a white hat hacker?+
A white hat hacker tests security with clear permission, stays within the agreed scope and reports findings so they can be fixed. Good intent alone does not replace authorisation.
What is the difference between black, white and grey hat hackers?+
White hats work with permission to improve security. Black hats pursue harmful or criminal objectives such as theft, extortion or sabotage. Grey hats may look for flaws without permission but without the conventional malicious objective associated with black hats.
Is grey hat hacking legal?+
Do not assume so. Accessing or testing a system without permission can breach law, contracts or policy even when no data is stolen. Laws vary by location; this game is educational and not legal advice.
What do red, blue, green, purple and yellow hacker hats mean?+
They are informal community labels whose meanings vary between sources. Hat Trick presents common interpretations but identifies them as non-standard. Real security work is better judged by permission, scope, conduct and impact.
Why does the game include Not Enough Evidence?+
A job title, outfit or claim is not enough to classify conduct. The evidence-first answer rewards players for avoiding confident guesses when authorisation, scope or behaviour is missing.
Is Hat Trick free and mobile friendly?+
Yes. Hat Trick is a free browser game with no sign-up. It supports touch, mouse, keyboard, drag-and-drop and a relaxed no-timer mode.