HTB Academy vs TryHackMe: which platform to pick in 2026

Two platforms show up every time someone starts learning pentest: HackTheBox (usually shortened to HTB) and TryHackMe (shortened to THM). They look alike from a distance — same promise of legal training, same terminal + browser style, same VPN to load — but they serve different audiences, they prepare for different certifications, and they cost different amounts.

This lesson compares them coldly, explains the OpenVPN setup that powers both, and explains why this course uses HTB Academy as the backbone and TryHackMe as a safety net.

Why you must go through a platform

Attacking a system that is not yours, without explicit written authorization, is a crime in every Western country. In France it is article 323-1 of the Penal Code, up to three years in prison and €100,000 in fines. In Canada it is article 342.1 of the Criminal Code. In the United States it is the Computer Fraud and Abuse Act. There is no gray zone for "I was just learning".

Cybersecurity lab platforms solve exactly this problem: they host intentionally vulnerable machines, they explicitly authorize you to attack them, and everything happens on an isolated network that you reach through an OpenVPN tunnel.

Several exist. The two you cannot skip are HackTheBox and TryHackMe.

HackTheBox — two products to keep separate

HackTheBox is a Cypriot company founded in 2017. It actually sells two separate products that beginners often mix up:

HTB Labs — the hackable machines

What it is: a catalog of hundreds of vulnerable virtual machines (the famous boxes), sorted by difficulty (Easy, Medium, Hard, Insane). You connect to the HTB VPN, you scan an IP, you compromise the machine, you grab two flags (user flag and root flag) and you submit their hash on the site.

What it is for: pure practice, for an advanced user who already knows what to look for. No courses, no hints, no videos. Each box is a standalone mini-CTF.

Price 2026: about €14/month for the VIP subscription (access to retired boxes and their official walkthroughs), €20/month for VIP+.

HTB Academy — the structured courses

What it is: a training platform with theory courses, videos, graded exercises, and — most importantly — job-role paths that stack modules to prepare for a specific job.

What it is for: learning, not just practicing. Each module contains a written course, commented examples, a small dedicated vulnerable instance with a graded exercise, and an end-of-module exam.

The Penetration Tester Path (often shortened to CPTS path because it prepares that certification) stacks 28 modules covering the whole trade, from basic Linux up to Active Directory lateral movement.

Price 2026: about €8 per module bought individually (paid in cubes, HTB's internal currency), or €490 for the Silver Annual plan that gives access to about 40 modules per year, or €890 for the Gold Annual that unlocks every module.

Do I need both HTB Labs AND HTB Academy?

No. For this course (or to prepare the CPTS), only HTB Academy is strictly needed. HTB Labs is extra practice: that is where you will grab additional boxes to consolidate before the exam, but it is not a priority in the beginning.

Our opening recommendation: HTB Academy Silver Annual (€490/year, about €40/month amortized) and nothing on HTB Labs until week 12 or 13.

TryHackMe — the guided entry door

TryHackMe is a British company founded in 2018. It sells one product: rooms.

What it is: each room is a guided lesson that stacks a teaching text, questions to answer as you read (the famous tasks), and often a target machine to attack over the TryHackMe VPN. It is very visual, very progressive, very well-suited to a strict beginner.

What it is for: discovery and catch-up. Someone who has never touched Linux, never scanned with Nmap, does not know what SSH is, will find TryHackMe rooms of 20 minutes that explain exactly these three things without drowning them.

Price 2026: about €12/month for the Premium plan, with a generous free tier (dozens of free rooms, including the Complete Beginner path).

VPN and .ovpn file — same mechanic on both sides

Both platforms use exactly the same access mechanic: an OpenVPN tunnel.

A VPN (Virtual Private Network) creates an encrypted tunnel between your machine and the platform network. Once the tunnel is up, your Kali Linux ends up "inside" the lab network and can reach the target machines by their private IP (typically 10.10.10.x on HTB, 10.10.x.x on TryHackMe).

In practice:

1. You download an .ovpn file from your account on the platform (Access or Connection Pack button).
2. You run sudo openvpn filename.ovpn in a Kali terminal.
3. The logs show Initialization Sequence Completed: the tunnel is up.
4. ifconfig shows a tun0 interface with an IP inside the platform network.
5. You can now ping the target machine from Kali.

This is not the same VPN as NordVPN, ExpressVPN or ProtonVPN

Do not mix them up. Consumer VPNs (NordVPN, ExpressVPN, ProtonVPN, Surfshark) are designed to mask your IP by tunneling your traffic through a third-party server. They are built for privacy, not to join a lab network.

The .ovpn file from HTB or TryHackMe does the exact opposite: it includes you inside a specific network so that you can attack machines there. It does not hide your public IP from any third site.

Technically both rely on OpenVPN or WireGuard, but the use case is completely different.

Can I run HTB with a commercial VPN in parallel?

Generally no. Running two OpenVPN clients on the same machine generates routing conflicts: packets no longer know which interface to leave from. The concrete result is that either you lose HTB access or you lose Internet access.

Turn off your commercial VPN during your lab sessions. On a public or university network, prefer to bring up the HTB VPN directly without extra layers.

Comparison table

Criterion	HTB Academy	TryHackMe
Nature	Structured courses + graded exercises	Progressive guided rooms
Target audience	Intermediate to advanced, certification prep	Strict beginner to intermediate
Teaching style	Dense text, methodology-oriented	Very visual, quizzes as you read
Guidance	Moderate: shown then left alone	High: questions to answer at every step
Certification prepared	CPTS (directly), OSCP (good base)	Prepares eJPT and PNPT, indirectly OSCP
Free tier	One free Getting Started module, rest paid	Generous: dozens of free rooms
Indicative monthly price	~€40 (Silver Annual amortized) or €8/module	~€12 (Premium) or €0 (Free)
Volume 2026	~200 modules, 6 job-role paths	~800 active rooms, ~15 learning paths
Lab type	Per-module dedicated instance (auto-paused)	Shared machine spun up on demand
Access method	OpenVPN + optional pwnbox terminal in browser	OpenVPN + preinstalled attacker machine in browser
Grading and progression	Per-module score, per-path completion badge	Cumulative points, daily streak, worldwide ranking
Final report?	Yes, required at Documentation & Reporting module	Not required in standard rooms
Community	Official Discord, moderated forum	Very active Discord, beginner-friendly

Our recommendation for this course

HackTheBox Academy as the mandatory backbone every week. Each module of this course maps to one or more modules of the HTB Academy Penetration Tester Path (the full mapping is in lesson 0.3). You spend your home training on those HTB modules.

TryHackMe as a safety net. If you fall behind on a topic — you did not get SMB, you are lost in Active Directory — you grab a TryHackMe room on exactly that topic, you finish it in 30 to 60 minutes, then you return to the matching HTB Academy module.

Our local Docker lab as weekly class exercise. Reproducible on Docker Desktop, no subscription needed, it powers in-class sessions.

HTB Labs (the boxes) becomes relevant from week 12, when you have enough methodology to face a machine with zero guidance. Before that, you would waste more time fumbling than learning.

Concrete order of spending for a strict-budget student

1. Weeks 1 to 5: nothing to pay on the platforms. The HTB Academy Getting Started module is free and covers our first five weeks. The local Docker lab does the rest.
2. Week 6: open a TryHackMe Premium subscription (~€12) for one month if you want extra guidance.
3. Week 7: open HTB Academy Silver Annual (~€490), the real investment of the year.
4. Week 12: optionally add HTB Labs VIP (~€14) for three months if you want to work boxes before the final mission.

Total minimum cost over 15 weeks: about €540, of which €490 for HTB Academy Silver Annual, which stays usable for a full year after that to prepare the CPTS.

Other platforms worth knowing

To round out your general awareness, the 2026 landscape also includes:

• PortSwigger Web Security Academy — free, specialized on web security (SQL injection, XSS, IDOR, request smuggling). The best web content on the market, HTB Academy included. Use it in parallel with our module 07 (OWASP Top 10).
• PwnedLabs — specialized on cloud security (AWS, Azure, GCP), launched in 2023. Becoming the reference for offensive cloud certification prep.
• Ludus — Bad Sector Labs' open project, to spin up a reproducible Active Directory lab at home. Serious alternative to GOAD (Game of Active Directory).
• VulnHub — catalog of downloadable .ova vulnerable machines to run locally on VirtualBox or VMware. Free, but everything is manual.
• Offensive Security Proving Grounds — OSCP-style machines rented from Offensive Security. Paid, expensive, but unavoidable if you seriously prepare the OSCP.

These platforms do not replace HTB Academy or TryHackMe for a full curriculum. They serve specific needs at specific moments, often beyond this course's fifteen weeks.

What to remember

• HTB Academy and HTB Labs are two different products from the same company. This course uses only HTB Academy.
• TryHackMe is more guided, less pro, ideal for discovery and catch-up.
• Both platforms use an OpenVPN tunnel with an .ovpn file — this is not a commercial VPN like NordVPN.
• This course picks HTB Academy as the backbone, TryHackMe as a safety net, with a local Docker lab for class sessions.
• Realistic minimum budget over 15 weeks: €540, of which €490 for HTB Academy Silver Annual.

Next step

Move to lesson 0.2 — Certifications to understand what you actually prepare by following this course: CPTS, OSCP, PNPT and eJPT, with real 2026 numbers.