CEH vs OSCP: which exam fits a penetration-testing goal?
CEH vs OSCP: if you already have the basics, choose the OSCP (OffSec Certified Professional) when your goal is penetration testing, hacking a company's systems with permission. Its exam allows nearly 24 hours to break into exam machines, then write a report. The CEH (Certified Ethical Hacker, from EC-Council) tests attack knowledge in four hours of multiple choice.
Of the 217 US penetration-tester ads we counted on Adzuna, a job-ad search site, in October 2026, 30% contained ceh and 73% contained oscp; one ad can name both. If you have no target job yet, see which one fits you.
| CEH | OSCP | |
|---|---|---|
| Awarded by | EC-Council, a company that certifies security professionals and sells training through partners | OffSec, a company that sells penetration-testing courses and exams |
| What the exam tests | Knowledge of attack methods, by multiple choice | Hands-on attacks on exam machines, plus a written report |
| Entry rule | Two years of information-security work, or official training | No formal prerequisite |
| Exam fee (US dollars) | $950 online or $1,199 at Pearson VUE (a test-center chain) | $1,699 for the exam alone, or $1,749 with 90 days of course and labs |
| Expiration | Every 3 years, renewed with 120 ECE credits (logged learning) and $80 a year | OSCP does not expire; the OSCP+, a three-year version issued with it, expires after 3 years |
Source: EC-Council and OffSec pages listed under Sources.
Show the numbers
| Country | CEH | OSCP |
|---|---|---|
| United States | 30% | 73% |
| United Kingdom | 21% | 48% |
CEH or OSCP: which do employers name more?
Instant answer from October 2026 job ads. No email needed.
OSCP is named in more job ads in the United States.
Source: Adzuna job ads, October 2026. Small sample: 217 ads. Treat this as a rough guide.
Get your full report
Two optional questions shape your first step. No email needed.
On this page
Which one should you choose?
Choose the OSCP for hands-on penetration testing; take the CEH when an employer or contract names it. Pick by the job you want and the skills you have now; the vendors' rules set no order between the two.
- No target job yet: open ten penetration-tester ads and ten security-analyst ads on any job site, and write down the daily tasks each lists. If attacking test systems appeals more than watching for alerts, the OSCP is the closer match; if watching for alerts appeals more, see the cybersecurity analyst page and CompTIA Security+ first.
- Help desk, IT support or system administration work: rate yourself on the three skills OffSec strongly recommends for its course. They are TCP/IP networking (how computers talk over a network), Windows and Linux administration (setting up and running those systems) and basic Bash or Python scripting (short programs that automate tasks). If all three are solid, aim for the OSCP. If one is weak, practice that skill first, then rate yourself again; an entry exam such as CompTIA Security+ (general security), CompTIA PenTest+ or the eJPT (junior penetration testing) can come first.
- Two years in a security role, or an employer that pays for training: the CEH knowledge exam is one you can take, and an ad or contract that names it is a reason to take it.
- You want both: OffSec sets no prerequisite and the EC-Council pages we read do not mention the OSCP, so the order is yours. The CEH needs the two years or official training either way. For the CISSP (a credential for running security programs), see the CEH vs CISSP and CISSP vs OSCP comparisons.
How do the CEH and OSCP exams differ?
The OSCP is harder to pass because it tests doing, while the CEH tests recall; neither vendor publishes a pass rate. The CEH knowledge exam checks what you know about attacks in four hours of multiple choice. The OSCP exam checks whether you can carry out attacks and document them, over nearly two days.
| CEH knowledge exam (312-50) | OSCP exam | |
|---|---|---|
| Format | 125 multiple-choice questions | 3 single, separate machines plus 1 Active Directory set of 3 machines (Active Directory is Microsoft's system for managing a network's users) |
| Time | 4 hours | 23 hours 45 minutes of hands-on work, then 24 hours to upload the report |
| Passing score | Varies by exam form (EC-Council gives two ranges) | 70 of 100 points |
| How it is watched | Proctored (watched live by a supervisor) online, or taken at a Pearson VUE center | Proctored by an OffSec employee; you reach the exam network over a private VPN (an encrypted connection) |
| Retakes | Up to five attempts in 12 months; no wait before the second, 14 days before each later one | Reported in OffSec's archived FAQ: $249 per retake (the exam-only purchase already includes two attempts); waits of 4 weeks after a first attempt, 8 after a second and 12 after later ones |
Source: EC-Council CEH, eligibility and retake pages; OffSec PEN-200 page, OSCP exam guide and standalone exam FAQ (archived copies, dates in Sources).
On the OSCP, each standalone machine is worth 20 points: 10 for initial access (getting a first way in) and 10 for privilege escalation (gaining administrator control). The Active Directory set is worth 40. OffSec's guide calls its report rules very strict: missing documentation can cut your points or zero them. The retake terms above come from OffSec's FAQ for the exam-only purchase, which does not say whether they apply to the course bundle. EC-Council does not publish a CEH retake price.
EC-Council awards the CEH when you pass the knowledge exam. Hands-on skill is tested in the optional CEH Practical, a six-hour exam with 20 challenges and a $550 voucher (a prepaid code that books the exam); passing both earns the title CEH Master.
Show the numbers
| Item | CEH | OSCP |
|---|---|---|
| Exam time | 240 minutes (4 h) | 1,425 minutes (23 h 45 min) |
| Passing score | 60–85% | 70 of 100 |
| Format | Multiple choice, hands-on practical | Hands-on practical |
| Where you take it | test center · online, proctored | online, proctored |
Where do EC-Council's pages disagree?
Two EC-Council texts give different wording on the CEH passing score and the experience rule.
| Topic | EC-Council text A | EC-Council text B |
|---|---|---|
| Passing score | CEH product page, exam-details table: 60% to 85% | Same page, FAQ: typical passing cut scores (the score needed to pass) of 65% to 85% |
| Experience | CEH product page: candidates should have 2 years in IT security or complete official training | Eligibility page: the program requires two years in an information-security role unless you attend official training |
Source: EC-Council CEH product page and application-and-eligibility page.
EC-Council says the passing score differs because questions rotate, giving each exam form (version of the question set) its own score. Because candidates apply through the eligibility page, plan by its stricter word, "requires."
Who can take each exam?
The OSCP has no formal prerequisite. The CEH exam needs two years of information-security work or EC-Council's official training.
OSCP. OffSec's course page says there are no formal prerequisites, and it strongly recommends TCP/IP networking, Windows and Linux administration and basic Bash or Python scripting. For the exam-only purchase, its FAQ recommends at least some experience in the field of penetration testing. PEN-200, the course behind the OSCP, lists 321 hours of content, more than 20 modules and 9 challenge labs (practice networks to break into).
CEH. Official training makes you eligible; EC-Council describes its official training as a five-day boot camp (an intensive full-time course) and leaves its price to training partners. Without training, you apply with proof of two years in information security and a non-refundable $100 application fee. EC-Council's application page gives 5 to 10 business days for approval. An approval is valid for 90 days, and a purchased exam voucher for 12 months.
What do the CEH and OSCP cost over three years?
Over three years and one passed attempt, the CEH self-study route costs $1,290 with the online exam or $1,539 at a Pearson VUE center. The OSCP costs $1,699 for the exam alone or $1,749 with OffSec's course bundle, because the OSCP itself does not expire; the OSCP+ renewal is not priced. No total includes study materials (the exam-only OSCP price includes no course), and the CEH totals leave out the cost of earning the 120 ECE credits.
| Part | CEH, self-study, online | CEH, self-study, Pearson VUE | OSCP+ Standalone Exam | OSCP Course + Cert Bundle |
|---|---|---|---|---|
| Entry | $100 application fee x 1 | $100 application fee x 1 | None | None |
| Exam or package | $950 voucher x 1 | $1,199 voucher x 1 | $1,699 x 1 (two attempts within 120 days per the archived FAQ, no course) | $1,749 x 1 (90 days of course and labs, one attempt) |
| Staying certified | $80 x 3 years = $240 | $80 x 3 years = $240 | $0 for the OSCP; OSCP+ renewal not priced | $0 for the OSCP; OSCP+ renewal not priced |
| Three-year total | $1,290 | $1,539 | $1,699 | $1,749 |
Source: EC-Council eligibility and continuing-education fee pages; OffSec PEN-200 page and standalone exam FAQ. Prices in US dollars.
Three other prices change the totals. On the CEH official-training route there is no application fee, so the online voucher plus three yearly fees comes to $1,190 before the training itself. OffSec's Learn One plan costs $2,749 a year for one year of course access and two exam attempts, and it renews automatically unless you cancel. An OSCP retake adds $249 beyond the attempts already included, and the optional CEH Practical adds $550.
Show the numbers
| Item | Fee |
|---|---|
| Fees to get certified: Exam | $1,699 |
| Fees to get certified: Official prep course (optional) | $1,749 |
| Fees to get certified: One retake (optional) | $249 |
How do you keep each credential?
The CEH must be renewed every three years; the OSCP has no renewal, and only the OSCP+ expires.
CEH. You earn 120 ECE (EC-Council Continuing Education) credits within the three years, through logged learning such as courses, and pay the $80 yearly fee, which applies to EC-Council certifications whose exam code starts with 312, such as the CEH's 312-50. EC-Council grants 40 ECE credits for passing another IT-security certification exam. If the credits are missing, the CEH is suspended; you have 12 months to make them up, after which it is revoked and you must pass the exam again.
OSCP. It has no expiration date. The OSCP+, which you earn at the same time, expires three years after it is issued. OffSec offers three ways to keep the OSCP+: pass a recertification exam within six months of the expiration date, pass another qualifying OffSec exam before it expires, or join OffSec's CPE (continuing professional education) program.
OSCP vs CEH: which do penetration-tester ads name?
Both acronyms appear in the US penetration-tester ads we counted on Adzuna in October 2026. We counted an ad when its text contained ceh or oscp.
| Penetration-tester ads | All ads | Containing ceh |
Containing oscp |
|---|---|---|---|
| United States | 217 | 66 | 158 |
| United Kingdom (small sample, read with care) | 58 | 12 | 28 |
Source: Adzuna API, job ads collected in October 2026. Analysis: CertWorthIt. Method.
An ad that names both is counted in both columns, so the columns overlap and cannot be added. India's penetration-tester sample was too small to report. A mention does not prove an employer requires the credential. The CEH is also counted in security-analyst ads; our cybersecurity-analyst page lists what those ads name.
What do Reddit posters ask about the CEH and the OSCP?
In the posts we collected on r/oscp and r/SecurityCareerAdvice (Reddit discussion boards), people asked where to start, what the OSCP exam allows and whether either credential pays off. These are questions from a self-selected group, not statistics.
- CEH or Security+ before the OSCP. Posters asked which should come first on the way to the OSCP (r/oscp). OffSec requires neither; build the three recommended skills, and see the Security+ page for its entry rule if you want a general entry exam.
- Whether the CEH helps land a first job. One poster weighed the CEH against Security+ and other entry exams for a first security job (r/SecurityCareerAdvice). Our ad counts show mentions, not hiring odds, and the CEH self-study route asks for two years of security work.
- Hack The Box practice plus one credential. A poster training on Hack The Box Academy, a hacking-practice site, asked whether to add the OSCP or the CEH (r/SecurityCareerAdvice). For someone already practicing attacks, the OSCP exam tests that skill directly; the CEH knowledge exam does not.
- What to learn next. A network engineer listed Python, Terraform (software that sets up cloud systems), SIEM tools (software that gathers security alerts), the CEH and the CISSP as possible next steps (r/SecurityCareerAdvice). For penetration testing, scripting is one of the three skills OffSec lists.
- Labs and resources next to the CEH. A poster asked which resources and labs to use (r/SecurityCareerAdvice). EC-Council's official course covers 20 modules with 221 hands-on labs.
- Tools on the OSCP exam. Posters asked whether a given tool is allowed (r/oscp). OffSec's guide allows Metasploit (an attack toolkit) against one target machine only. It bans commercial tools, automatic exploitation tools such as sqlmap, mass scanners (tools that scan whole networks for known flaws) such as Nessus and AI chatbots, and says it will not rule on tools beyond the guide.
- How long OSCP study takes. Posters asked when to book the exam and whether six to nine months is enough (r/oscp). Ten posters who described finished preparation, including people who failed, reported 2 to 10 months of study, with a median (middle value) of about 4.5 months; these are self-reports, not a measured average.
- The PEN-200 course and its labs. Posters asked whether to focus on the course (r/oscp). The bundle gives 90 days of access from purchase and Learn One a year, so the access clock starts when you buy.
- Whether the OSCP is worth it. Four posts asked this (r/oscp). It fits if you want penetration-testing work and the three skills in the choice section are solid; the cost section and the ad counts are the parts we can measure.
- Jobs after the OSCP. Posters asked how others found work after passing (r/oscp). OffSec names penetration tester and SOC (security operations center) analyst, someone who watches a company's security alerts, among the roles the OSCP can open the door to; that is the vendor's statement, not job data.
What we did not check
- Pass rates and salaries. Neither vendor publishes a pass rate on the pages we read, and we do not report salaries.
- CEH training and retake prices. Training partners set training prices, and EC-Council publishes no retake price.
- OSCP+ renewal costs. We did not price the recertification exam or OffSec's CPE program.
- OSCP lab extensions and result times. We did not check the price of extra lab time or how long OffSec takes to send a result.
- Retake rules for the OSCP bundle. The $249 retake and the waiting times come from the exam-only FAQ.
- Whether EC-Council grants ECE credits for the OSCP.
- Exam-guide changes. OffSec's help pages blocked our reader, so the exam guide and FAQ come from archived copies and may have changed.
Sources
EC-Council pages were read October 4, 2026, and OffSec pages October 8, 2026. An archived copy is a saved copy of a page from the date given.
- EC-Council: CEH product page, application process and eligibility, exam retake policy, ECE policy, continuing education fees.
- OffSec: PEN-200 and OSCP page; OSCP exam guide, archived copy of September 21, 2026; standalone exam FAQ, archived copy of September 27, 2025.
- Job ads: Adzuna API, October 2026, penetration-tester ads; acronyms
cehandoscp. Analysis: CertWorthIt. Method. - Reddit: posts collected from r/oscp and r/SecurityCareerAdvice, linked where cited. The OSCP study-time figure comes from posts in r/oscp.
Questions people ask
Is the CEH or the OSCP harder?
They test different things, and neither vendor publishes a pass rate. The CEH (Certified Ethical Hacker, from EC-Council) knowledge exam asks 125 multiple-choice questions in four hours, and its passing score depends on which exam form (version of the question set) you get. The OSCP (OffSec Certified Professional) is hands-on: OffSec's exam guide gives 23 hours and 45 minutes to break into exam machines on an exam network, then 24 more hours to upload a written report. You need 70 of 100 points, and a weak report can cost points. For a beginner, the OSCP takes far more practice time, while the CEH asks you to memorize.
OSCP vs CEH: which should I take first?
Neither vendor sets an order between them. The OSCP (OffSec Certified Professional) has no formal prerequisite, though OffSec strongly recommends networking knowledge, Windows and Linux administration and basic scripting in Bash (a command-line shell) or Python (writing small programs). The CEH (Certified Ethical Hacker) exam needs two years of information-security work or EC-Council's official training. If penetration testing, attacking systems with permission to find weak spots, is your goal, the OSCP exam is closer to that work.
Can I take the CEH or the OSCP with no experience?
Yes, with conditions. OffSec sets no formal prerequisite for the OSCP (OffSec Certified Professional), but strongly recommends networking, Windows and Linux administration and basic scripting skills (Bash, a command-line shell, or Python). For the exam-only purchase, its FAQ recommends at least some experience in penetration testing. For the CEH (Certified Ethical Hacker), EC-Council accepts official training in place of the two years of information-security work. Without training, you must prove two years and pay a non-refundable $100 application fee. EC-Council does not set the training price; its training partners do.
How much do the CEH and the OSCP cost over three years?
On EC-Council's self-study route, the CEH (Certified Ethical Hacker) costs $1,290 over three years with the online exam: the $100 application fee, the $950 exam voucher (a prepaid code that books the exam) and three yearly fees of $80. With a Pearson VUE (a test-center chain) voucher at $1,199, the total is $1,539. The OSCP (OffSec Certified Professional) does not expire, so its three-year cost is the purchase: $1,699 for the exam alone with two attempts, or $1,749 for 90 days of course and labs with one attempt, in US dollars. None of these totals includes study materials, the cost of earning the 120 ECE credits or the OSCP+ renewal, which are not priced.
Do the CEH and the OSCP expire?
The CEH (Certified Ethical Hacker) is valid for three years. To keep it, you earn 120 ECE credits (EC-Council Continuing Education points for logged learning, such as courses) in those three years and pay EC-Council $80 a year. The OSCP (OffSec Certified Professional) does not expire. Passing OffSec's exam also earns the OSCP+, a version that expires three years after it is issued; OffSec renews it through a recertification exam, another qualifying OffSec exam or its continuing-education program.
Which do penetration-tester job ads name, the CEH or the OSCP?
Both appear. Of the 217 US penetration-tester ads we counted on Adzuna, a job-ad search site, in October 2026, 30% contained the acronym ceh (Certified Ethical Hacker) and 73% contained oscp (OffSec Certified Professional). An ad that names both is counted for each, so the two shares overlap and cannot be added. A mention does not show that an employer requires the credential.