The largest bug bounty platform, where security researchers report vulnerabilities to companies and earn bounties. Open sign-up, with invitations to private programs as reputation grows.
HackerOne is a bug bounty platform where anyone can register to start earning, and the work can be done remotely. Fees are Bounties set by each program, the minimum payout is No minimum for PayPal, $50 local bank, $100 SWIFT, $15 crypto and you can withdraw via PayPal, Bank transfer, Bitcoin and USDC. Founded in 2012, HackerOne is based in San Francisco, California, United States. It is available worldwide.
Last updated
What people actually earn on HackerOne
Figures published by HackerOne or by independent studies and surveys, as dated. Individual earnings vary widely.
Can I join HackerOne?
Under 18 needs parental consent, and payouts need a Veriff ID check plus an approved tax form.
Official requirements ↗ · Check which platforms you can join →
How HackerOne compares
- HackerOne is the only one of the 10 bug bounty platforms we track that pays out via Bitcoin.
- Founded in 2012, HackerOne has been running for about 14 years — longer than 8 of the 10 bug bounty platforms we track with a known launch year.
Compared with the bug bounty platforms in our directory. See them all →
Is HackerOne legit?
HackerOne is a real, operating platform. What we could verify:
- Operating since 2012 (14 years)
- Headquartered in San Francisco, California, United States
- Has a Wikipedia article
Listing last updated September 2026 · how we verify platforms · Missing or out of date? Tell us
Frequently asked questions
How much does HackerOne charge?
HackerOne fees: Bounties set by each program.
How do you get paid on HackerOne?
HackerOne pays out via PayPal, Bank transfer, Bitcoin and USDC. Minimum payout: No minimum for PayPal, $50 local bank, $100 SWIFT, $15 crypto.
Which countries is HackerOne available in?
Worldwide.
How much do people earn on HackerOne?
HackerOne paid out $81 million in bug bounties to hackers during 2025, per its 9th annual Hacker-Powered Security Report. HackerOne states more than $380 million has been rewarded to hackers across its bug bounty programs to date. Individual earnings vary widely.
Is HackerOne legit?
Yes, HackerOne is a real, operating platform: operating since 2012 (14 years), headquartered in San Francisco, California, United States and has a Wikipedia article. As with any platform, check its current terms before relying on it for income.
What are the best HackerOne alternatives?
Similar platforms include Synack, Cobalt, Bugcrowd and Zerocopter. Compare their fees and payouts in the alternatives section below.
Compare HackerOne with…
HackerOne alternatives
More bug bounty platforms like HackerOne
SynackA vetted security testing platform whose Red Team accepts researchers only after skills assessment and background checks. Members get steady…
synack.com45 views
CobaltA pentest-as-a-service platform whose vetted Cobalt Core community of pentesters earns from structured engagements rather than open bounties…
cobalt.io51 views
BugcrowdA crowdsourced security platform running bug bounty and vulnerability disclosure programs. Researchers earn cash for valid findings, ranked…
bugcrowd.com42 views
ZerocopterA Dutch security platform running bug bounty and coordinated vulnerability disclosure programs with a community of invited researchers.
zerocopter.com90 views
HackenProofA bug bounty platform from the Hacken security ecosystem, focused on web3 and crypto projects with public and private programs.
hackenproof.com48 views
IntigritiA European bug bounty platform connecting ethical hackers with companies across the continent and beyond. Known for community events and fas…
intigriti.com47 views