TryHackMe vs HackTheBox: Where Should Beginners Start?

Every beginner in cybersecurity hits the same fork in the road within their first month: TryHackMe or HackTheBox? Both are legitimate platforms with real machines to hack, but they're built for different stages of the learning curve, and picking the wrong one first can slow you down or make you quit.

What TryHackMe actually gives you

TryHackMe is structured around guided rooms. Rooms like "Linux Fundamentals" or "Web Fundamentals" walk you through concepts step by step, often with embedded questions that force you to actually read the material instead of skimming for a flag. The learning paths (Pre Security, Cyber Security 101, Jr Penetration Tester) chain rooms together into something resembling a curriculum.

This matters if you don't yet know what a reverse shell is, how SSH works, or why nmap -sV gives you different output than nmap -sC. TryHackMe assumes you might not know, and it tells you. The free tier is generous enough to get through a lot of the fundamentals content before you need a subscription.

What HackTheBox expects from you

HackTheBox has almost no hand-holding by default. You get an IP address and a machine name (retired boxes have writeups available; active ones don't). No hints unless you pay for them or dig through community Discord servers. The philosophy is sink-or-swim: you're expected to Google, read documentation, and piece together an attack chain from partial information.

This is closer to what a real penetration test or CTF competition feels like. Machines are also rated by difficulty (Easy, Medium, Hard, Insane) and tagged by technique, so once you know roughly what you're doing, you can grind specific skills like Active Directory enumeration or Windows privilege escalation.

The actual difference that matters

It comes down to scaffolding. TryHackMe hands you the ladder. HackTheBox hands you the wall and tells you climbing gear exists somewhere. Neither is objectively better, they solve different problems. A total beginner dropped into HackTheBox with zero Linux experience will spend three hours just figuring out how to use gobuster correctly, and not in a productive way, more in a frustrating way that kills motivation.at the same time, someone who's spent six months only doing guided TryHackMe rooms can hit a wall on HackTheBox because they've never had to enumerate a target without a checklist telling them what tool to run next.

A realistic sequence

Start with TryHackMe's Pre Security and Cyber Security 101 paths if you don't already know basic networking (TCP/IP, ports, DNS) and basic Linux command line. Budget a few weeks here, not months. Rushing this stage means you'll be pattern-matching commands without understanding what they do, which falls apart the moment a machine deviates from the tutorial script.

Once you can comfortably enumerate a box with nmap, identify a service version, and search for a matching exploit on Exploit-DB or searchsploit without being told to, move to TryHackMe's offensive path rooms (like those covering OWASP Top 10) and start mixing in HackTheBox's Starting Point track, which is HTB's own answer to the