Career pathPentest certifications
Penetration testing and ethical hacking certifications, compared on facts
Penetration testing and ethical hacking certifications come in three formats: a multiple-choice knowledge exam (CEH), mixed exams with hands-on items (PenTest+, GPEN), and fully practical exams (CEH Practical, CPENT, OSCP, eJPT). Format, length and price for each, as each issuer published them (checked Oct 11, 2026), are in the table below.
- Exam
- 312-50
- Updated
- Oct 11, 2026
Seven certifications on one sheet
| Certification | Issuer | Format | Length | Price ($) |
|---|---|---|---|---|
| CEH | EC-Council | 125 multiple-choice questions | 4 hours | $950 voucher, remote proctored |
| CEH (Practical) | EC-Council | 20 practical challenges in a cyber range, online proctored | 6 hours | Sold with CEH: $1,250 or $1,499 package |
| CPENT | EC-Council | Fully practical, plus a written report | One 24-hour or two 12-hour sessions | Not published |
| PenTest+ (PT0-003) | CompTIA | Up to 90 questions, multiple choice and performance-based | 165 minutes | Price on the issuer's site |
| OSCP / OSCP+ | OffSec | Proctored practical: three standalone machines and an Active Directory set, plus a report | 24 hours | Exam $1,699; course and exam $1,749 |
| GPEN | GIAC | 82 questions including CyberLive hands-on items, proctored | 3 hours | $999 per attempt |
| eJPT | INE Security | Practical, auto-graded | On the issuer's site | Price on the issuer's site |
CEH prices are the EC-Council store's remote-proctored voucher and the CEH plus Practical packages (remote or Pearson VUE). Prices change without notice; every source is listed at the end of this page.
Who issues what, and how the credentials stack
| Issuer | Certifications | How they connect |
|---|---|---|
| EC-Council | CEH, CEH (Practical), CPENT | Pass CEH and CEH (Practical) for CEH (Master); score above 90% on CPENT for LPT (Master) |
| CompTIA | PenTest+ (PT0-003) | A separate line; CompTIA does not issue CEH |
| OffSec | OSCP / OSCP+ | OSCP+ is the OSCP credential that expires after three years |
| GIAC | GPEN | A separate line, sold per attempt |
| INE Security | eJPT | The junior practical; the credential lasts three years |
Choosing by what the job needs
Start from the job posts, not from the certification. If postings in your area name one credential, that one carries the points and everything else is optional reading. If they name none, choose by what you need to prove.
Breadth: you know the field
CEH spans nine domains, from reconnaissance to cryptography, and tests recognition by multiple choice. PenTest+ covers testing with performance-based items mixed in; the CEH vs PenTest+ comparison goes row by row.
Hands-on: you can do the work
A practical exam is the evidence. Inside EC-Council's line that means the CEH Practical exam, or CPENT, where EC-Council says a score above 90% also earns LPT (Master). Outside it, OSCP is a 24-hour proctored practical with a report, and the CEH vs OSCP page sets out how the two differ.
Starting from zero
eJPT is INE Security's junior practical. INE says its voucher stays valid for 180 days and includes one free retake within 14 days, and the credential lasts three years. Cisco's entry route is weighed in CEH vs Cisco Ethical Hacker.
Names that sound alike
- Licensed Penetration Tester (LPT Master)
- EC-Council's credential for scoring above 90% on CPENT. It is a private certification; no government license is involved.
- CEH (Master)
- Awarded by EC-Council when you pass both the CEH knowledge exam and CEH (Practical).
- OSCP+
- OffSec's OSCP credential that expires after three years.
- Ethical Hacking Essentials
- A separate EC-Council program with a similar name. Its details were not verified for this page, so check EC-Council's own page before comparing it.
- CISSP and CHFI
- They come up in the same searches. CISSP (ISC2) is a security-management certification and CHFI is EC-Council's forensics one; neither is a penetration testing exam, so neither is in the table.
Picking a certification
What is the best penetration testing certification?
The one the jobs you want ask for. Format is the next filter: multiple choice to show breadth, a practical exam to show you can run a test. Price and length for each are in the table above (Oct 11, 2026).
Is there a licensed penetration tester certification?
EC-Council awards LPT (Master) for scoring above 90% on its CPENT exam, per its CPENT page as of Oct 11, 2026. It is a private credential; no government license is involved.
Can you take these certifications online?
Several of them, yes: CEH through EC-Council's remote proctoring service, CEH (Practical) online proctored, and GPEN through ProctorU or Pearson VUE, per each issuer (Oct 11, 2026). OffSec proctors the OSCP exam as well.
Sources
- EC-Council certification body, Certified Ethical Hacker
- EC-Council store, CEH exam voucher (remote proctored)
- EC-Council store, CEH and CEH (Practical) package
- EC-Council store, CEH Pearson VUE and Practical package
- EC-Council certification body, CEH (Practical)
- EC-Council, CEH (Master)
- EC-Council, Certified Penetration Testing Professional (CPENT)
- CompTIA, PenTest+
- OffSec, PEN-200 and OSCP
- GIAC, Penetration Tester (GPEN)
- GIAC, certification pricing
- INE Security, eJPT