Security payout
Bug Bounty Calculator
Enter a severity, an asset class, and the dollar ranges from your bounty table. The calculator estimates a payout in US dollars. The draft stays in this browser. The result is a planning figure, not an award.
Estimated payout
- Recommended amount
- —
- Adjusted range
- —
- Severity
- —
- Asset class
- —
- Proof of concept
- —
- Researcher receives
- —
- Each researcher
- —
Enter a severity and an asset class, or keep the starting table. The estimate updates as you type.
Compare a second table
Enter another minimum and maximum for the same severity. The second figure is not a winner. It is only a reading check against the first table.
Enter a second minimum and maximum for this severity to see another estimate.
Continue this table
The same ranges open in the other tools. Nothing is sent to a server. You can keep up to five recent tables in this browser.
No saved tables yet. Estimate a payout, then use Save this table.
Try a finished finding
Each example is a real result from this calculator, then a question you can answer in the fields above.
When to use this payout estimate
Use it when you already have a bounty table, and you want a single dollar figure for one finding. If the range is wide, the geometric mean sits inside the range instead of hugging the floor. If the asset is secondary or peripheral, the calculator reduces the range first, then takes that mean. A proof of concept adds 25 percent before rounding. The page does not look up another company’s table and does not promise that a platform will pay this amount.
Other checks
CVSS to bounty
Map a CVSS score to a severity band, then use the same payout formula.
Program budget
Multiply expected valid findings by the table, then add a fee and a reserve.
How a bounty table works
What the minimum, the maximum, and the geometric mean are doing.
Questions
How does this Bug Bounty Calculator estimate a payout?
You enter a severity band and an asset class, plus the minimum and maximum dollars on your bounty table. The calculator multiplies the range by the asset factor, takes the geometric mean, optionally adds 25 percent for a proof of concept, and rounds to the nearest $50. The result stays inside the adjusted range.
Is the starting table an industry average?
No. The starting amounts are a typical public-program order of magnitude, so the fields are not empty. Replace them with the dollars your policy actually pays.
Does this page award a bounty?
No. The number is a planning estimate. A program still decides the award.
Does “bounty calculator” mean a poker or game tool?
People also use that phrase for poker mystery bounties and tabletop treasure. This site estimates a security payout from a bounty table. It does not estimate poker expected value or a game reward.
Does this page send the numbers anywhere?
No. After the files load, the estimate stays in this browser. A copied link keeps the numbers in the address itself. Clearing this site’s stored data removes the last table and the five saved tables.
What does “researcher receives” mean?
If you enter a platform fee, the calculator subtracts that percent from the recommended amount. Enter 0 when the program pays the researcher directly. The cut is a planning figure, not a platform invoice.
What does a researcher split do?
If more than one researcher shares the award, enter how many people split the amount after the platform fee. The calculator divides evenly. A program can still choose a different split.
Can I copy a sentence instead of the dollar figure?
Yes. Copy a one-line summary writes the severity, the asset, the recommended amount, and the take-home after the fee. The text stays in this browser until you paste it.
Does the second table win the comparison?
No. The second minimum and maximum only show another estimate for the same finding. You still choose the table a program can stand behind.