He created and operates Have I Been Pwned?, a data breach search website that allows users to see if their personal information has been compromised.

[23] He later removed the VTech breach from the database, stating that only two people besides himself had access to the data and wishing to reduce the chance of its spread.

[27] Also in November 2017 Hunt joined Report URI, a project (launched in 2015 by Scott Helme) which allows real-time monitoring of CSP and HPKP violations on a website.

[5][non-primary source needed] Additionally, Hunt works in education by speaking at technology conferences and running workshops.

His primary workshop, titled Hack Yourself First, aims to teach software developers with little security background how to defend their applications by looking at them from an attacker's perspective.