TryHackMe now sells eight certifications, but almost everyone asking about TryHackMe certifications means two of them: SAL1 for SOC analysts and PT1 for junior pentesters. Both cost $349, both are practical exams you take in the browser, and neither comes with a Premium subscription, whatever older reviews say.
Below: what each cert costs, what the fee actually buys, how the exams work, and an honest answer to whether employers care. For the wider market, see our guide to cybersecurity certifications. If SAL1 is your target, you can start building the core skill today in HackerDNA's SOC analyst and blue team course.
Updated September 2026 with current prices, the full eight-cert lineup and the new PT1 price.
TL;DR: TryHackMe certifications are practical, unproctored, in-browser exams. SAL1 and PT1 each cost $349 for two exam attempts, stay valid for 3 years, and do not include Premium. They are worth it as proof you can do the work, but HR recognition still trails CompTIA and OffSec, so pair one with a better-known cert if job ads in your area filter on names.
Are TryHackMe Certifications Worth It?
Yes, if you want practical proof of skill at a low price. No, if you need a name that clears HR keyword filters. SAL1 and PT1 test hands-on work (triaging alerts in a simulated SOC, compromising web, network and Active Directory targets and writing reports), which says more about you than a multiple-choice score. But they are only a year or two old, and far fewer job ads ask for them than for Security+, CySA+ or OSCP.
Do TryHackMe certificates mean anything? Are they valid? Two different things share the name. The certificates of completion you get for finishing a learning path (a Premium perk) show you did the coursework, nothing more. The certifications are real, paid exams with a pass/fail result, a Credly badge an employer can verify, and a 3-year validity. They are legitimate credentials; the open question is only how many hiring managers know them yet.
- Worth it: career changers who need a practical signal, SOC or pentest candidates whose target employers test skills in interviews, TryHackMe learners already on the matching path.
- Less worth it: anyone applying to government or large-enterprise roles where the ad names a specific cert (usually Security+ or CySA+).
- Best of both: SAL1 plus Security+, or PT1 plus an established pentest cert later.
All 8 TryHackMe Certifications and Their Prices
TryHackMe prices each certification as a one-off purchase in your local currency. The US dollar price is published for SAL1 and PT1; for the rest we show the euro price TryHackMe displays to European buyers (SAL1 and PT1 cost EUR 301 there, so add roughly 15% for a US dollar estimate).
| Certification | Code | Level / audience | Price |
|---|---|---|---|
| Pre Security | SEC0 | Absolute beginner | EUR 59 |
| Cyber Security 101 | SEC1 | Beginner, broad foundations | EUR 131 |
| Security Analyst Level 1 | SAL1 | Junior SOC analyst | from $349 (EUR 301) |
| Junior Penetration Tester | PT1 | Junior pentester | $349 (EUR 301) |
| Web App Pentester Level 1 | WEB1 | Junior web app tester | EUR 262 |
| AI Security | AI1 | AI and LLM security | EUR 345 |
| Security Analyst Level 2 | SAL2 | Intermediate SOC analyst | EUR 645 |
| Penetration Tester Level 2 | PT2 | Intermediate pentester | EUR 645 |
What the fee actually buys
- Two exam attempts: the exam plus one free retake. The retake can start 3 days after you started the first attempt.
- 12 months to use them: attempts are valid for a year from purchase (TryHackMe certification access).
- 3 years of validity: each certification is valid for 3 years from the day you start the exam. Today you renew by passing the exam again.
- No Premium: the training paths are a separate subscription. Older articles claiming "3 months of Premium included" are out of date.
How to pay less
- Subscriber discount: Premium subscribers get 15-25% off (TryHackMe's pricing page ties it to annual plans), and MAX subscribers get 40% off one certification. Our TryHackMe pricing breakdown covers the plans.
- Bundles: buying a pair (for example PT1 + PT2, or SEC0 + SEC1) saves 20% on each cert.
SAL1 Certification: Exam Format and Price
SAL1 (Security Analyst Level 1) is TryHackMe's entry-level SOC analyst exam, built with Accenture and Salesforce and launched in February 2025. It costs from $349 and has no formal prerequisites.
| Section | Time limit | Weight | What you do |
|---|---|---|---|
| Multiple choice | 1 hour | 20% | 80 questions on SOC fundamentals, frameworks and tooling |
| SOC Simulator scenario 1 | 2 hours | 40% | Work a live alert queue: triage, investigate in the SIEM (Splunk), classify, report |
| SOC Simulator scenario 2 | 2 hours | 40% | A second, separate incident scenario |
The sections run in order and must all be finished inside a 24-hour window, so plan for about five hours of real exam time plus breaks.
In practice, the SOC Simulator rewards a steady triage rhythm more than deep rabbit holes. Alerts land in a queue, you decide true or false positive, and you write up each case. Spending 40 minutes perfecting one alert while a dozen others sit untouched is the classic way to run out of clock, so practise closing alerts with a short, clear case note before exam day.
Exam tip: close every true positive alert before each 2-hour timer runs out. Alerts still open when time expires score zero, even if you had identified them correctly.
PT1 Certification: Exam Format and Price
PT1 (Junior Penetration Tester) costs $349, up from $297 when it launched. You get a 48-hour window in TryHackMe's "Pentest Simulator" to work through three scenarios:
- Web application (60%): the usual junior-level suspects such as broken access control, injection and authentication flaws.
- Network security (20%): enumeration, service exploitation and privilege escalation.
- Active Directory (20%): enumeration, attacks on a Windows domain such as Kerberoasting and AS-REP roasting, and pivoting (reviewers recommend being fluent with a tool like Ligolo-ng).
Each scenario ends with a case report, and reports are graded by an AI-driven review process. You get your own lab, full internet access and no tool restrictions, so Burp Suite, Nmap, BloodHound and your own scripts are all fair game. The exam is not proctored.
To pass you need at least 750 points from the flags you collect and reports that meet the bar. Because an AI grades them, follow TryHackMe's recommended report structure closely.
The report matters as much as the flags
Reviewers who passed PT1 keep repeating the same warning: hacking every target is not enough if the write-up is weak. For every finding, capture:
- What the vulnerability is and where it lives
- Step-by-step reproduction, with screenshots
- A severity rating (a CVSS calculator such as cvss.js.org keeps this consistent)
- A concrete fix
Write findings up as you go, not in the last three hours. That habit is also the one that matters most on a real engagement.
SAL1 vs PT1: Which One Should You Take?
| SAL1 | PT1 | |
|---|---|---|
| Target role | SOC analyst (defensive) | Junior pentester (offensive) |
| Price | from $349 | $349 |
| Exam time | About 5 hours inside a 24-hour window | 48 hours |
| Format | 80 MCQs + two SOC Simulator scenarios | Three practical scenarios + reports |
| Core skills | SIEM, alert triage, case notes | Web, network and AD testing, reporting |
| Recommended prep | Cyber Security 101 + SOC Level 1 paths | Junior Penetration Tester + Web Fundamentals paths |
Pick by the job you want, not the exam you think is easier. SOC analyst is the more common entry-level role, which makes SAL1 the safer first cert for most people. PT1 makes sense if you already enjoy CTFs and want to move towards penetration testing.
TryHackMe vs BTL1, CySA+, eJPT and PJPT
SOC analyst certs: SAL1 vs BTL1 vs CySA+
| Certification | Price | Format | Validity |
|---|---|---|---|
| TryHackMe SAL1 | from $349 | MCQ + two 2-hour SOC simulations | 3 years |
| Centri (formerly Security Blue Team) BTL1 | £399, includes 4 months of training | 24-hour practical incident response exam | Lifetime |
| CompTIA CySA+ (CS0-004) | $439 list price | Up to 85 MCQ and performance-based questions, 165 minutes | 3 years |
SAL1 is the cheapest and the most job-shaped of the three. BTL1 (Security Blue Team renamed itself Centri in June 2026) has several more years of reputation among SOC hiring managers and bundles its training. CySA+ moved to version CS0-004 in June 2026; it is mostly a question-based exam and CompTIA pitches it at people with several years of experience, but it is the name most likely to appear in a job ad.
Junior pentest certs: PT1 vs eJPT vs PJPT
| Certification | Price | Exam | Scope |
|---|---|---|---|
| TryHackMe PT1 | $349 | 48 hours, reports graded | Web, network, Active Directory |
| INE eJPT | $249 | 48-hour hands-on lab, answer questions, no report | Mostly network, some web |
| TCM Security PJPT | $249, includes 12 months of training | 2 days of testing + 2 days to write the report | Internal network and Active Directory |
PT1 is the only one of the three that covers web, network and Active Directory in a single exam, which is why it costs a bit more. eJPT is the gentlest start; PJPT is the most report-focused and a natural step towards TCM's PNPT.
How to Prepare for SAL1 and PT1
SAL1
- Cyber Security 101 path Networking, Linux, Windows and security basics
- SOC Level 1 path Triage, SIEM, phishing and traffic analysis. Our SOC Level 1 path guide breaks down all 14 modules
- Free SOC Simulator scenarios Get used to working an alert queue against the clock
PT1
- Junior Penetration Tester path Recon, web vulnerabilities, exploitation and privilege escalation
- Web Fundamentals path Deeper web application testing
- Extra web and AD practice The exam's web and AD scenarios go beyond the basics, so add PortSwigger Web Security Academy and HackerDNA's Active Directory attacks course
Budget two to four months of steady study if you are new, less if you already do CTFs or work in IT.
Frequently Asked Questions
How much do TryHackMe certifications cost?
SAL1 and PT1 each cost $349 (EUR 301). The full range runs from EUR 59 for Pre Security (SEC0) to EUR 645 for SAL2 and PT2. Premium subscribers get 15-25% off, MAX subscribers 40% off one cert, and bundles save 20%.
Does a TryHackMe certification include Premium?
No. The purchase covers two exam attempts (exam plus one free retake) usable for 12 months. The learning paths that prepare you need a separate Premium subscription.
Do TryHackMe certifications expire?
Yes. They are valid for 3 years from the date you start the exam. For now you renew by passing the exam again.
Are TryHackMe certifications recognized by employers?
Increasingly, but not widely yet. SAL1 was built with Accenture and Salesforce, and practical exams impress technical interviewers. Job ads still name Security+, CySA+ and OSCP far more often, so treat a TryHackMe cert as a strong complement rather than a replacement.
Should I get SAL1 or BTL1?
SAL1 is cheaper and closer to a real SOC shift thanks to the simulator. BTL1 has a longer track record, lifetime validity and bundled training. On a tight budget or if you already use TryHackMe, SAL1; if recognition among blue team hiring managers matters most, BTL1.
Is PT1 harder than eJPT?
Generally yes. PT1 adds Active Directory and graded reports on top of web and network testing, while eJPT is a question-based lab exam focused mostly on networks.
Are TryHackMe exams proctored?
No. Both run in the browser without proctoring software, and PT1 places no restrictions on tools.
Legal and Ethical Considerations
Critical reminder: Only test systems you own or have explicit written permission to test. Exam and lab environments are built for practice; a certification never grants permission to test anything else.
- Use legal practice environments: TryHackMe, HackerDNA labs or your own home lab.
- Report responsibly: anything found during authorized work goes through the agreed channel.
- Protect data: treat logs and evidence you handle as confidential.
Last verified: September 2026. Prices and exam details confirmed on TryHackMe's certification and help pages, Centri's BTL1 page, CompTIA, INE and TCM Security.
Your Next Steps
TryHackMe certifications are a solid, affordable way to prove you can do the work: SAL1 if you want a SOC seat, PT1 if you want to test systems for a living. Just go in knowing they are still earning their reputation with recruiters.
- Heading for a SOC? Build triage habits in HackerDNA's SOC analyst and blue team course and the Log Hunter lab, then take SAL1.
- Heading for pentesting? Sharpen web and AD skills, write a practice report for every lab you solve, then book PT1.
Everything on HackerDNA runs in the browser, no VPN or VM needed. Start with the free tier, no credit card required.
Part of the Cybersecurity Certifications series
Related articles:
- TryHackMe Certifications
- Security+ Certification Cost
- eJPT Certification
- PNPT Certification
- CompTIA PenTest+ Certification
- OSCP Preparation Guide
