I have taken all three, and they are not really competitors. One of them asks you to break into machines for a day. The other two ask you whether you know how.
The numbers, side by side
| OSCP | CompTIA PenTest+ | CEH v13 | |
|---|---|---|---|
| Certification body | OffSec | CompTIA | EC-Council |
| Exam code | PEN-200 | PT0-003 | CEH v13 |
| What the exam is | 24 hours of hands-on hacking in a private lab, then a written report | Maximum of 90 questions, multiple choice and performance-based | 125 multiple-choice questions |
| Time allowed | 24 hours, plus 24 more to submit the report | 165 minutes | 4 hours |
| Passing score | 70 points out of 100 | 750 on a scale of 100 to 900 | Varies by exam form, between 60% and 85% |
| Separate practical exam | There is no separate one. The practical is the exam | Performance-based items sit inside the written exam | Optional 6-hour practical, 20 challenges, needed for CEH Master |
| Cost | $1,749 Course + Cert bundle $1,699 exam only $2,749 a year for Learn One |
$439 USD | On-demand course from $1,699 |
| Experience expected | None required | Three to four years in a pen testing role, recommended | Training or an eligibility application |
| Expires | OSCP never expires. OSCP+ expires after three years | Three years, renewed with CEUs | Renewed with ECE credits |
Checked against OffSec, CompTIA and EC-Council on 19 September 2026. Prices change without notice and vary by region and reseller.
The difference that matters
Only one of these is an exam you can fail by not being able to do the job
OSCP puts you in a lab for 24 hours with machines to compromise, and grades you on whether you got in. There is no partial credit for knowing the theory. You either got the shell or you did not, and then you write it up properly or you lose the points anyway.
PenTest+ and CEH are knowledge exams. PenTest+ adds performance-based items in a simulated interface, which is more than CEH does. Neither asks you to compromise a real host under time pressure.
That is why OSCP carries the weight it does with hiring managers, and why it costs four times what PenTest+ costs.
CEH is the only one where the pass mark moves
EC-Council sets the cut score for each exam form, anywhere from 60% to 85%. It depends on how hard EC-Council judges that set of questions to be. You do not know which one you drew. Plan for 85% and you will never be caught out.
OSCP and OSCP+ are not the same credential
The OSCP does not expire. The OSCP+ expires three years from issue. They come from the same exam. Check which one you were awarded before you assume yours is permanent.
Price is not the whole cost
PenTest+ at $439 is one exam sitting. OSCP at $1,749 buys 90 days of course and lab access plus a single attempt. Most people do not pass first time, so budget for a retake. CEH’s $1,699 is a course price. EC-Council prices the exam voucher separately and gates eligibility, so confirm the total before you commit.
So which one
OSCP if you want to be a penetration tester
It is the one the job market treats as proof. No experience gate, no prerequisites, and no way to pass it by reading. Expect months of lab time and expect the first attempt to be a learning experience. The 24-hour format punishes people who have not built stamina in advance.
Full breakdown: OSCP.
PenTest+ if you need a credential on paper and a budget that survives it
It’s vendor-neutral, it appears in job postings and US federal workforce requirements, and it costs about a quarter of OSCP’s price. It covers the whole engagement lifecycle including scoping, reporting and the legal side, which OSCP largely skips. It shows you know how an engagement runs, though not that you can break in.
Full breakdown: CompTIA PenTest+.
CEH if your employer or a contract asks for it by name
That’s the main reason to take it. HR departments widely recognise it, and it appears on approved lists. The v13 syllabus is also broad. As preparation for real testing, it’s the weakest of the three. The exception is the six-hour practical, the one part that asks you to do something.
Full breakdown: CEH v13.
Taking more than one
PenTest+ then OSCP works well. PenTest+ gives you the vocabulary, the methodology and the reporting discipline cheaply, and OSCP then tests whether you can apply it. Going straight to OSCP is common and entirely doable. It’s just a harder landing.
CEH alongside either is a box-ticking decision rather than a skills one. If a contract requires it, take it. If nothing is asking for it by name, the same money goes further elsewhere.
Self-taught security pro. No degree, just certs, labs, and a lot of late nights.