CEH or OSCP: a knowledge exam or a 24-hour hack, and who needs which
EC-Council's CEH v13 voucher is $950 for the online exam, plus a non-refundable $100 application for candidates who skip official training, as of November 2026. OffSec sells the OSCP+ exam alone for $1,699, or $1,749 with the PEN-200 course and 90 days of labs. CEH tests knowledge of attack techniques with 125 multiple-choice questions in four hours; OSCP asks you to break into machines for nearly 24 hours and then write a report. If you want to prove hands-on skill, OSCP is the test of it; if you need the credential a requirement names, check which one it names.
CEH and OSCP in one table
| CEH | OSCP | |
|---|---|---|
| Issuer | EC-Council | OffSec |
| Current version | CEH v13; EC-Council releases a new version every 12 to 18 months | PEN-200 course and the OSCP+ exam |
| Exam | 125 multiple-choice questions in 4 hours; EC-Council gives the passing score as 60% to 85% | 23 hours 45 minutes of hands-on attack work, then 24 hours to submit a report; three standalone machines (60 points) and an Active Directory set (40 points) |
| Exam price (US) | $950 online proctored voucher, $1,199 through VUE | $1,699 exam only; $1,749 with PEN-200 and 90 days of labs |
| Formal gate | Yes: official EC-Council training, or two years of information security work plus a non-refundable $100 application | None |
| Recommended background | Two years of IT security experience (EC-Council) | TCP/IP networking, Windows and Linux administration, some Bash or Python (OffSec) |
| Hands-on option | Optional CEH (Practical): 20 challenges in 6 hours; passing both gives CEH (Master) | The whole exam is practical |
| Validity and upkeep | Three years; 120 continuing education credits and an $80 annual fee | OSCP never expires; OSCP+ lasts three years, kept by a recertification exam, another qualifying OffSec exam, or continuing education with $145 a year in maintenance |
| What it signals | Broad knowledge of attack techniques and countermeasures, and a credential some employers and contracts name | Proof you can compromise machines and an Active Directory environment under time pressure and report it |
Knowledge of attacks against doing them
CEH covers a wide catalogue of attack techniques, with AI-driven techniques added in v13, and checks that you know how they work and how to counter them. Its main exam is multiple choice; the hands-on CEH (Practical) is a separate, optional sitting that none of the pages we read priced. OSCP has no multiple-choice part at all. You get machines and an Active Directory set, nearly a full day to compromise them, and a second day to write a report another tester could follow. Lab hours, not reading, decide the result.
Getting in: EC-Council's gate and OffSec's open door
EC-Council gates the CEH exam. You either complete official EC-Council training or prove two years of information security work and pay the $100 application; approval takes 5 to 10 working days and lasts 90 days. Without that experience, official training is the only way in, so check in writing that any class you book counts as official training. OffSec sets no gate: anyone can buy the exam. Its recommendations (networking, Linux and Windows administration, a little scripting) are the real bar, because the exam assumes them from the first minute.
What each route costs
| Route | CEH | OSCP |
|---|---|---|
| Cheapest published route | $1,050: the $100 experience application plus the $950 online voucher | $1,699 exam only, if you already have PEN-200-level preparation |
| Official course from the issuer | $1,699 to $2,649 on demand, depending on whether the voucher is included; live online from $2,499 (voucher also not stated) | $1,749: PEN-200, 90 days of labs and one attempt |
| Longer access or a second attempt | Free retakes depend on the EC-Council package; ask in writing | Learn One, $2,749 list ($2,199 on offer when checked): 365 days of labs and two attempts |
| Five-day class from a training company | $3,495 (New Horizons, voucher included) to $3,850 (Learning Tree, voucher included); ONLC $3,495 with no voucher stated, $4,445 if you add one | None in our research; OffSec sells PEN-200 directly |
For someone who qualifies on experience, CEH is the cheaper first attempt by $649 against the OSCP exam alone. Without the experience, the cheapest way in is EC-Council's own on-demand course from $1,699; its page does not say whether the $950 voucher is included, so that route is $1,699 to $2,649, against $1,749 for OffSec's course-and-exam bundle. A voucher-inclusive five-day CEH class ($3,495 or more) costs more than a year of Learn One at $2,749 list. Over three years, CEH adds $240 in annual fees ($80 a year). OSCP alone costs $0 to keep; keeping OSCP+ on the continuing-education route costs $435 ($145 a year).
Common questions
- Is OSCP harder than CEH?
- They test different things. CEH checks knowledge in four hours of multiple choice; OSCP is a nearly 24-hour practical exam plus a report, and OffSec expects administration and scripting skills going in.
- Can I take CEH without a course?
- Yes, with two years of information security work and EC-Council's $100 application.
- Does OSCP expire?
- OSCP does not. OSCP+, issued with it, expires after three years unless you renew it.
- Is there a hands-on CEH?
- Yes, the optional CEH (Practical), 20 challenges in six hours. Passing it and the knowledge exam earns CEH (Master).
Situations that point to CEH or to OSCP
- A contract or job listing requires CEH by name: CEH. OSCP does not substitute for a named requirement.
- You want a penetration-testing or red-team job: OSCP, because the exam is hands-on attack work plus a written report.
- Two years in a security role, small budget, need a credential this quarter: CEH on the experience route, $1,050.
- No security experience yet: neither first. Start with Security+; if Linux or networking is the gap, close it before PEN-200.
- Defensive analyst work: neither; see CySA+.
Next step
Ask which one your goal calls for
Sources
- EC-Council: Certified Ethical Hacker v13 (version, exams, eligibility, packages), checked November 5, 2026
- EC-Council: application process and eligibility (application fee, voucher prices), checked November 5, 2026
- EC-Council: continuing education (ECE) policy, checked November 5, 2026
- OffSec: pricing (Learn One, Course + Cert Bundle), checked November 5, 2026
- OffSec: PEN-200 (standalone exam price, OSCP and OSCP+ validity, prerequisites), checked November 5, 2026
- OffSec: annual membership (maintenance fee), checked November 5, 2026
- OffSec: OSCP exam guide (format and points), checked November 5, 2026
Prices are published list prices we recorded on the dates shown, not quotes. How we research.
Class prices come from the named providers, as listed and dated on the certification pages linked above.