Quick answer
TryHackMe documents a structured model built from rooms, tasks, modules, and learning paths, with browser-based practice through the AttackBox and a virtual private network (VPN) option for using your own machine. Start with Free to inspect the instructional style and setup. Premium becomes relevant when you need full beginner and intermediate learning paths or unlimited AttackBox use. MAX becomes relevant only when its advanced or cloud content, persistent AttackBox, or plan-specific certification benefit is material to your next study block.
TryHackMe’s training-content overview,
AttackBox documentation,
and
MAX-plan documentation
establish those product boundaries.
In a United States USD view checked on , the current official plan-page representation displayed Free at $0, Premium at $16.99 monthly or $10.50 per month when billed annually, and MAX at $30.73 monthly or $18.99 per month when billed annually. Treat these as dated displayed amounts, not a checkout quote. Recheck currency, tax, billing basis, eligibility, and the exact path you want before paying.
See the current official plan page.
Evidence and scope
- Evidence profile
- E1 — source-led product analysis
- Information checked
- Target market
- United States, with prices displayed in US dollars
- Direct evaluation
- Not performed
- Scope
- TryHackMe’s documented learning structure, room and workspace model, individual plans, current displayed pricing, cancellation and refund rules, and material limitations
- Main limitation
- No account, checkout, learning path, room, AttackBox, VPN connection, cancellation flow, support interaction, accessibility behavior, device behavior, or performance workflow was directly tested.
TryHackMe’s
Terms of Use
identify TryHackMe Ltd as the operator of the website. This article uses official public pages to explain what the product documents, what each individual plan appears to include, and what a buyer still needs to verify. It is not a hands-on review, ranking, or promise that the platform will fit a particular learner.
Pricing-source note: the public pricing route exposed its current page representation to search indexing but rendered only the page shell in this review browser. No account or checkout was used. The dated amounts below should therefore be rechecked on the live plan page and at checkout before purchase.
Key facts
- TryHackMe documents rooms as pages containing tasks, questions, downloadable material, or attached virtual machines. Rooms may be walkthrough, challenge, or network-oriented.
- Learning paths group modules, and modules group rooms. Public documentation establishes the hierarchy but does not prove that every path has consistent teaching quality or progression.
- Free users are documented as having limited learning-path and room access plus up to one hour of AttackBox use per day; a VPN connection from the learner’s own machine is an alternative.
- Premium and MAX are separate paid tiers. MAX sits above Premium and includes advanced or cloud content and a persistent AttackBox that are not documented as standard Premium features.
- Plan boundaries are volatile. TryHackMe has retired or replaced learning paths, and its current MAX documentation describes named paths moving between tiers.
- Cancellation stops renewal rather than ending access immediately. Progress remains saved, while subscriber-only access ends when the paid period expires.
- Monthly memberships are documented as non-refundable. Annual refund eligibility is narrow and conditional.
The factual structure above is supported by the official
rooms documentation,
room-difficulty guide,
AttackBox guide,
cancellation guide,
and
refund policy.
Who should use this analysis
Use this analysis if you are a beginner or early-intermediate learner considering TryHackMe for structured cybersecurity study and authorized practice. It is especially relevant when you are deciding among the Free, Premium, and MAX tiers but do not yet know whether your goal requires a full learning path, longer browser-workspace access, advanced content, or a persistent cloud workspace.
If you are still deciding which cybersecurity direction to study, start with the Course Evidence guide to choosing a cybersecurity learning path. This page begins one step later: it assumes TryHackMe is already on your shortlist and helps you inspect its documented model.
This analysis does not decide whether TryHackMe is universally “worth it.” A useful decision depends on a defined learning goal, the exact path or rooms you intend to use, the time you can study, whether you can use your own machine through VPN, and whether an unresolved accessibility, device, support, or reliability question is material. The goal is a bounded plan decision, not a platform verdict.
Free, Premium, and MAX at a glance
Scroll horizontally if all four columns are not visible.
| Plan | Displayed price | Documented access | Decision condition |
|---|---|---|---|
| Free | $0 | Limited learning-path access, free rooms, and up to one hour of AttackBox use per day | Use it to inspect the learning style, navigation, room format, and setup before making a paid commitment. |
| Premium | $16.99 monthly, or $10.50 per month when billed annually | Full beginner and intermediate learning paths, unlimited AttackBox, path-completion certificates, and a documented certification discount | Consider it when the exact beginner or intermediate path and longer browser-workspace access are material to your plan. |
| MAX | $30.73 monthly, or $18.99 per month when billed annually | Premium features plus documented advanced and cloud paths, recent-threat content, persistent AttackBox, and different certification-discount terms | Consider it only after verifying that a MAX-only path or feature is necessary for the next study block. |
Takeaway: the meaningful comparison is not simply “free versus paid.” It is whether the exact path and workspace feature you need are included in the selected tier at the time you subscribe.
The official plan comparison
and
MAX-plan guide
should be rechecked immediately before purchase.
Learning paths and room structure
Rooms, tasks, modules, and paths are different layers
TryHackMe documents a hierarchy in which a room contains one or more tasks, and a task may contain questions, downloadable material, or a virtual machine. Rooms may be grouped into modules, and modules may be grouped into learning paths.
The rooms guide
and
training-content overview
describe these layers.
A buyer should therefore inspect more than a path title. Check the prerequisites, the room sequence, the mix of explanation and practice, the transition from guided work to challenges, and whether the path ends at the capability you want. Public documentation can show structure; it cannot establish that the sequence will be coherent for your background.
Walkthrough, challenge, and network rooms serve different purposes
Walkthrough rooms are documented as combining explanation with hands-on work. Challenge rooms emphasize applying knowledge, while network rooms can represent larger environments such as Active Directory or corporate networks.
TryHackMe’s room definitions
and
difficulty guide
support this distinction.
Do not treat a difficulty label as evidence of instructional quality. A useful path should have the right balance of explanation, guided tasks, independent application, and review for your current skills. That balance was not directly evaluated for this article.
Check path freshness and tier placement
TryHackMe has documented the retirement or replacement of older learning paths, including Complete Beginner, Introduction to Cyber Security, and Cyber Defense. The same notice explains that some legacy versions remain temporarily visible and that some rooms or modules may be removed.
The path-change notice
is a concrete reason to date-check the path you plan to follow.
Plan placement can also change. The current MAX guide describes several advanced paths moving from Premium to MAX. Before subscribing, write down the exact path name and verify its current tier rather than relying on an older article, screenshot, or cached comparison.
Review the current MAX inclusions.
Labs, AttackBox, and setup
The AttackBox is a browser-based workspace, not the target machine
TryHackMe describes the AttackBox as a cloud-based Ubuntu virtual machine with tools for completing room tasks in the browser. Some tasks also start a separate target machine. The two systems have different purposes and addresses, so a learner should verify which machine is the workspace and which is the authorized target.
The AttackBox guide
explains the distinction.
Free users are documented as receiving up to one hour of AttackBox use per day. The same guide documents VPN access from the learner’s own machine as an alternative. Premium removes the daily AttackBox cap, while MAX adds a persistent AttackBox that resumes with saved files and installed tools.
The plan page
and
MAX documentation
establish those plan boundaries.
Questions to answer before paying
- Can your device and browser use the room interface comfortably?
- Is one hour of daily AttackBox access enough for your trial period?
- Can you use your own machine over VPN if you need longer sessions?
- Do you need files and tools to persist between sessions, or can you work with a resettable environment?
- Does the exact room or path require attached machines, downloads, or tools not covered by the browser workspace?
- Are keyboard, screen-reader, bandwidth, latency, or mobile constraints material to you?
These are evaluation questions, not observed results. This article did not measure startup time, latency, reliability, accessibility, browser compatibility, or VPN setup difficulty. Use the Cybersecurity Lab Evaluation Checklist to record the same workspace, access, policy, and unknowns questions before subscribing.
Keep practice inside authorized scope
TryHackMe’s
Acceptable Use Policy
prohibits unauthorized access and interference with systems or networks. Use only provider-authorized targets and follow the rules attached to the room, account, exam, and community. This is an educational boundary, not legal advice or operational intrusion guidance.
Pricing, renewal, cancellation, and refunds
Current displayed individual pricing
The current official plan-page representation displayed the following US-dollar amounts on : Free at $0; Premium at $16.99 monthly or $10.50 per month when billed annually; and MAX at $30.73 monthly or $18.99 per month when billed annually.
Check the live plan page
before relying on these figures.
The amounts are not a final invoice. TryHackMe documents localized individual pricing in GBP, USD, EUR, and INR. Market, currency, tax, promotion, payment method, and eligibility can affect what appears at checkout.
The local-currency guide
explains the supported currencies.
Student discount
The current student policy documents a 20% discount on Premium Annual only. It does not apply to monthly plans or MAX and does not stack with other discounts. The discount is applied after the required student information is completed in the account.
Review the student-discount conditions.
Do not calculate a guaranteed student total from this article. Confirm eligibility and the final checkout amount in the account before paying.
Renewal and cancellation
TryHackMe documents subscriptions as recurring. Canceling stops automatic renewal but does not immediately end access; benefits continue until the end of the current billing period. Progress remains saved, while subscriber-only rooms and premium features become unavailable when the subscription expires.
The cancellation guide
describes these effects.
The cancellation workflow was not directly observed. Before purchase, record the renewal date and verify how the selected plan appears in the account. After canceling, confirm the renewal state rather than assuming the request succeeded.
Refund conditions
The current refund policy says monthly memberships are billed in advance and are non-refundable. Annual memberships have a seven-day cooling-off condition only if no course material has been accessed or downloaded. MAX Annual adds a certificate-voucher condition: using the voucher removes refund eligibility.
Read the full current refund policy
before accessing content or using a voucher.
This is a dated summary, not legal advice or a promise that a particular request will be approved. Preserve the checkout record and contact the provider when a material condition is unclear.
Lower-commitment alternatives
A paid subscription is not the only valid next step. Before upgrading, you can:
- use the Free plan to inspect room wording, task structure, navigation, and the one-hour AttackBox limit;
- use the documented VPN option with your own machine when that is permitted and technically suitable;
- choose one exact learning path and verify its current tier before paying;
- delay MAX until a MAX-only path or persistent AttackBox is needed;
- compare another platform with the same learning, workspace, access, cancellation, and freshness questions; or
- use non-subscription resources while resolving a material device, accessibility, support, or budget constraint.
Free access can reveal instructional style and setup requirements, but it cannot establish full paid-catalog value or long-term fit. That conclusion should remain separate from the product’s marketing claims.
Unknowns and limitations
- No account, checkout, learning path, room, task, AttackBox, VPN, target machine, cancellation, refund, support, or certification workflow was directly tested.
- No conclusion is made about teaching effectiveness, room-to-room coherence, hint quality, support responsiveness, platform reliability, latency, accessibility compliance, mobile use, or device compatibility.
- The article does not establish a catalog-wide room, module, or path count because official pages can be dated and plan boundaries change.
- Displayed prices may change and may differ by market, tax, promotion, eligibility, or checkout state.
- Path availability is volatile. Named paths have been retired, replaced, or moved between tiers.
- Path-completion certificates and TryHackMe certifications are different. This article does not evaluate credential recognition, exam quality, pass rates, hiring outcomes, salary, or career impact.
- Vendor claims about being beginner-friendly, job-ready, employer-recognized, or better than another platform are not treated as independent evidence.
- No affiliate relationship, commission, commercial CTA, or product ranking is included.
Recheck all 13 required sources after , or earlier if the plan page, MAX guide, refund policy, or path inventory changes.
Make a plan decision
- Define one next learning block. Write the exact path or room group, the capability you want, and the time available.
- Use Free first. Inspect the instructional style, task format, and workspace setup without inferring paid value.
- Verify tier placement. Confirm that the exact path and required workspace feature are included in Free, Premium, or MAX today.
- Record the current terms. Capture market, currency, billing basis, renewal date, cancellation effect, refund condition, and student eligibility.
- Choose the least-committed tier that removes a real blocker. Do not pay for MAX solely because it is the highest tier.
- Delay when a material unknown remains. Accessibility, device, support, or reliability requirements should be resolved before a long billing commitment.
The decision is complete when you can name the exact content you will use, the workspace you need, the amount and billing basis shown at checkout, and the condition that would make you cancel or downgrade.
Methodology
This E1 product analysis was assembled from 13 official TryHackMe pages checked on . The source set covers operator identity, content hierarchy, room types, the AttackBox, individual plans and displayed prices, MAX features, student discount, localized currency, cancellation, refund conditions, path changes, and acceptable-use boundaries.
Each material factual paragraph remains inside the 13-claim boundary established for OE-A002. Official documentation supports the stated structure, plan features, and policies. The current official pricing-page representation supports the dated displayed amounts, while the browser-rendering limitation and absence of checkout access remain visible. Editorial conclusions are limited to a buyer-decision method: use Free to inspect the model, pay only when a documented feature removes a real constraint, and keep unknowns visible.
No account, direct learner validation, commercial relationship, or product comparison was used. A source-led analysis can establish documented boundaries; it cannot establish teaching quality, platform reliability, personal fit, or career outcomes.
Sources
- Terms of Use, TryHackMe Ltd. Checked August 25, 2026.
- Training content overview, TryHackMe Customer Hub. Checked August 25, 2026.
- Rooms, TryHackMe Customer Hub. Checked August 25, 2026.
- Room difficulty levels, TryHackMe Customer Hub. Checked August 25, 2026.
- Premium Plans, TryHackMe. Checked August 25, 2026.
- The AttackBox Explained, TryHackMe Customer Hub. Checked August 25, 2026.
- Understanding the MAX Plan, TryHackMe Customer Hub. Checked August 25, 2026.
- Student Discount, TryHackMe Customer Hub. Checked August 25, 2026.
- Can I Pay in My Local Currency?, TryHackMe Customer Hub. Checked August 25, 2026.
- Cancelling Your Subscription, TryHackMe Customer Hub. Checked August 25, 2026.
- Refund Policy, TryHackMe Customer Hub. Checked August 25, 2026.
- Big Changes on TryHackMe: Retired Three Learning Paths, TryHackMe Customer Hub. Checked August 25, 2026.
- Acceptable Use Policy, TryHackMe. Checked August 25, 2026.