OffSec OSWE Certification: Your Complete Decision Guide

OSWE, the OffSec Web Expert credential built on the WEB-300 course, requires candidates to manually exploit real web applications through white-box source-code review and chain multiple flaws into working exploits, all inside a 48-hour proctored exam scored on a 100-point scale with an 85-point passing bar. That structure alone separates it from multiple-choice application security credentials.

At roughly $1,749 for the training and exam bundle, and with real prep time measured in months rather than weeks, the practical tradeoff is clear: cost and difficulty against career payoff, a topic we cover in our Are Certifications Worth It? guide.

Candidates already know the name and want numbers: eligibility expectations, exam mechanics, retake pricing, realistic failure rates for the underprepared, salary ranges by role, and where OSWE sits against OSCP, OSEP, and the GWAPT certification. Demand for source-level exploitation skill continues outpacing supply across security teams, which is exactly why this credential commands attention despite its narrow scope.

OSWE Credential Snapshot

Vendor-neutral web application certifications tend to test knowledge through multiple-choice questions, while the OffSec Web Expert (OSWE) demands live exploitation across a grueling, hands-on exam. Here is a quick-reference table covering the essentials.

• Full name: OffSec Web Expert (OSWE)
• Issuing organization: OffSec
• Associated course: WEB-300: Advanced Web Attacks and Exploitation
• Exam duration: 47 hours 45 minutes, followed by a 24-hour report submission window¹
• Passing score: 85 out of 100¹
• Delivery mode: Remote, proctored, VPN-based lab environment³
• Formal prerequisites: None enforced by OffSec²
• Expiration: The OSWE does not expire once earned²
• Program level: Expert-tier offensive security certification

No formal eligibility gate means anyone can register, but the exam difficulty assumes significant prior experience with web application security and source-code review. The 85-point threshold is one of the highest in the OffSec certification lineup, reinforcing the credential's reputation as a rigorous, senior-level validation of real-world exploitation skill. Details above reflect the current WEB-300 OSWE Exam Guide published by OffSec, last verified in 2026.¹

What the OSWE Validates

The OSWE certification does not measure how well you can run a vulnerability scanner. It validates your ability to manually tear apart a web application's source code, find subtle flaws, and write custom exploits that chain multiple weaknesses into a full compromise.

White-Box Exploitation and Source Code Review

Unlike other penetration testing credentials such as the OSCP certification that focus on black-box discovery, the OSWE is a white-box exam. Candidates receive full access to an application's codebase and must audit it line by line. The curriculum spans PHP, .NET/C#, and JavaScript/Node.js, with PostgreSQL as the primary database backend.¹ Java is not currently part of the exam domains.¹ This deep-dive approach demands fluency in reading and reasoning about code, not just pointing a tool at a URL.

You will work with real-world vulnerability classes, including blind SQLi, persistent and DOM-based XSS, .NET deserialization, server-side template injection (SSTI), XML external entity (XXE) attacks, server-side request forgery (SSRF), prototype pollution, file upload bypass, CORS/CSRF misconfigurations, and command injection.¹ The course was refreshed in 2024 and later to incorporate modern attack surfaces like GraphQL exploitation and JWT confusion, but the exam remains rooted in manual source-code review and handcrafted exploits.²

Core Skill Pillars: Audit, Chain, and Script

What you demonstrate on the OSWE exam breaks into three practical areas. First, source-code auditing: you must identify injection points and logic flaws in PHP type juggling, magic hashes, PostgreSQL extensions and large objects, and Node.js prototype pollution.¹³ Second, authentication bypass and injection chain development: you pivot from one weakness to the next, chaining vulnerabilities until you achieve remote code execution or data exfiltration. Third, custom exploit scripting: every proof-of-concept is written in Python.² Automated scanning tools are absent from the exam environment, so your ability to craft working exploits by hand is non-negotiable.²

The Exam Report Requirement

Earning the OSWE is not just about breaking things. The exam requires a professional-quality penetration test report that documents each step of your attack chain. To pass, you must complete four objectives worth 25 points each within a 47.75-hour testing window² and submit a report that meets OffSec's technical writing standards.¹ A passing score shows you can not only find and exploit vulnerabilities but also communicate findings to a development team or client.

Who Should (And Should Not) Pursue the OSWE

The web application security specialty has fractured into two camps over the last few years: automated scanner operators and manual exploit developers. OSWE is squarely aimed at the second camp, and that framing determines whether this credential is right for you.

The Ideal Candidate Profile

OSWE fits mid-career practitioners who already have two or more years of hands-on web security work. The learners who finish WEB-300 and pass on the first or second attempt typically fall into three groups:

• Penetration testers who want to move past network exploitation into complex web application chains and source-code review.
• Application security engineers who audit code for a living and want a credential that proves they can weaponize the bugs they find, not just report them.
• Web developers transitioning into offensive security, who bring language fluency (PHP, Java, C#, Python, Node.js) but need structured training in attacker methodology.

SOC analysts moving toward red-team work and existing OSCP holders specializing in web applications also do well here, provided they are willing to read and debug code rather than lean on tooling.

Who Should Wait

OSWE is not a first certification, and OffSec does not market it as one. You should hold off if any of the following apply:

• You are an entry-level IT professional without production web development or security testing experience.
• You lack OSCP-level comfort with enumeration, exploitation, and pivoting on networked systems.
• Reading unfamiliar source code in at least one server-side language makes you freeze rather than curious.
• You prefer study-and-memorize credentials. OSWE requires you to build custom exploit chains under a 48-hour clock, debug them when they break, and document reproducible steps.

Formal Prerequisite vs Recommended Baseline

The only formal prerequisite is enrollment in WEB-300 (Advanced Web Attacks and Exploitation) through a course bundle or an active OffSec Learn subscription that includes it, though like many advanced cybersecurity certification prerequisites, the real entry bar is higher than what's listed on paper.

The recommended skill baseline, however, is substantial:

• Code fluency: Comfortable reading PHP, Java, C#, or Python well enough to trace user input from request to sink.
• HTTP internals: Deep understanding of headers, sessions, cookies, CORS, and request smuggling concepts.
• Manual exploitation: Prior hands-on work with SQL injection, XSS, deserialization, and authentication bypasses beyond what a scanner surfaces.
• Tooling: Daily-driver familiarity with Burp Suite, a debugger, and scripting your own proof-of-concept code.

Recommended stepping stones include OSCP for general offensive foundations, OSWA (Offensive Security Web Assessor) for structured web methodology, or two-plus years in an application security role.

Exam Format, Domains, Scoring, and Proctoring Rules

Eighty-five out of 100 points is the minimum passing score on the OSWE exam, and every point must be earned through hands-on exploitation of real web applications and then documented in a professional-grade report.¹ Understanding the format in detail before you sit down is essential, because this exam tests writing discipline just as rigorously as it tests technical skill.

Exam Structure and Duration

The OSWE exam gives you two target web applications, each with full source-code access. You have 47 hours and 45 minutes to analyze the code, discover vulnerabilities, and build working exploit chains against both targets. Once that window closes, a separate 24-hour report-writing window begins. The total commitment, from start to final submission, can stretch across roughly three days.

Each target carries multiple objectives, and OffSec awards points per objective completed. As of 2026, there are four scored objectives across the two machines, with each objective worth 25 points for a total of 100.¹ Objectives map to specific exploitation milestones such as authentication bypass, remote code execution, or data exfiltration, and partial credit is not guaranteed for incomplete chains. You need at least 85 points, meaning you cannot afford to leave an entire objective unfinished.

Proctoring and Tool Restrictions

The exam is delivered online with live proctoring. You are required to share your webcam feed and your screen throughout the exploitation window, and OffSec monitors your VPN connection to the lab environment. The exam is open-book: your own notes, blog posts, and online documentation are all fair game. However, several categories of tools are explicitly prohibited:

• AI chatbots and large language models: You cannot use ChatGPT, Copilot, or any similar assistant.
• Automated exploitation tools: SQLmap, mass vulnerability scanners, and automated source-code analyzers are not allowed.
• Pre-built exploit frameworks that remove the need for manual analysis are similarly off-limits.

The philosophy here is straightforward: OffSec wants proof that you can read code, reason through vulnerabilities, and craft exploits manually.

The Report Requirement

This is where many technically capable candidates fail. After the exploitation window, you must produce a penetration test report that documents every step of your exploit chain, complete with screenshots, proof flags, code snippets, and a clear narrative a reader could follow to reproduce your attack. An incomplete or poorly organized report results in a failing grade, even if you successfully compromised both targets during the exam.

OffSec awards points not just for capturing flags but for proving you captured them through a documented, reproducible process. Think of the report as half the exam. Candidates who treat it as an afterthought routinely receive failing scores despite strong technical performance.

Retake Policy

As of 2026, there is no mandatory waiting period between exam attempts. If you fail, you can schedule a retake as soon as you are ready, though each retake attempt carries a $249 exam fee.² That zero-day cooldown (similar to policies we outline in our Online Cybersecurity Exams: Proctoring and Retakes guide) is relatively generous compared to other advanced certifications, but the cost of repeated attempts adds up quickly, which is another reason thorough preparation and strong report-writing habits matter before your first sitting.

Full Cost Breakdown: Training, Exam, Retakes, and Subscriptions

The total cost of earning OSWE depends on how you choose to prepare and how many exam attempts you need. OffSec's OffSec pricing page outlines a few core purchase routes, each suited to different timelines and budgets. The numbers below reflect published pricing for 2026, current as of mid-2026.

Official Purchase Options

• Course & Certification Bundle: At $1,749, this is the most focused package. It gives you 90 days of access to the WEB-300 course material and labs, plus a single OSWE exam attempt.¹ If you already have solid web application testing experience and can commit to an intensive 90-day study window, this is the cheapest way to sit the exam.
• Learn One Subscription: Priced at $2,749, this annual plan includes one course (in this case, WEB-300), 365 days of lab access, and two OSWE exam attempts. The extra exam retake and a full year to practice make this the safer choice for people who need flexibility or anticipate needing more hands-on reps before exam day.
• Learn Unlimited Subscription: At $6,299, this is the all-access pass. It covers every OffSec course and lab, along with multiple exam attempts across certifications. For a cybersecurity professional planning to stack several OffSec credentials (like OSCP and OSWE), the per-credential cost can drop significantly.

Hidden Costs and Retake Fees

If you fail the exam without a spare attempt, an OSWE Exam Retake Voucher costs $249 per additional attempt.² There is no mandatory training renewal fee for the credential itself. However, as OffSec updates course content, your lab access naturally expires. If you let your subscription lapse and need to refresh later, you'll be buying into a new plan.

Deciding Which Route to Take

The bundle works well for disciplined learners who can dedicate 15 to 20 hours a week for three months straight. The Learn One subscription suits most career changers and working professionals who need a more forgiving study pace. Learn Unlimited makes sense only if you're committed to earning at least two other OffSec certifications and can treat the subscription as a professional development investment.

What About Third-Party Training?

At the time of writing, no major third-party bootcamps, such as INE or community-run courses, publicly list a bundle that wraps in the OSWE exam voucher directly. Self-study using free or low-cost resources can certainly supplement your preparation, but the exam itself can only be purchased through OffSec's official routes. Budget accordingly: the core expense is always the official training and exam access.

How Difficult the OSWE Exam Is and How to Prepare

White-box web application exploitation demands a fundamentally different mindset than network penetration testing, and candidates who underestimate the code-review depth required often struggle on their first attempt. The OSWE exam is not about finding vulnerabilities quickly; it is about reading thousands of lines of source code methodically, identifying subtle logic flaws, and chaining them into working exploits under a strict time limit, a process that benefits from following How to Prepare for a Cybersecurity Certification Exam.

Realistic Study Timelines by Background

Preparation time varies dramatically based on your starting point:

• Experienced web application pentesters with code review skills: 2 to 3 months of focused study, primarily reinforcing exploit automation and reviewing WEB-300 materials.
• OSCP holders new to source-code auditing: 4 to 6 months, with significant time spent building code-reading fluency in PHP, Java, and Python.
• Developers transitioning into offensive security: 6 to 9 months, because while coding skills transfer well, learning exploitation methodology and attack chaining takes substantial practice.

These timelines assume 10 to 15 hours of weekly study. Candidates working full-time security roles may compress these ranges slightly, and those studying part-time should extend them and consider following a Cybersecurity Certification Study Plan for Working Adults.

Practice Platform Effectiveness

Not all preparation resources carry equal weight. Here is how the most commonly recommended platforms rank for OSWE readiness:

• WEB-300 Course Labs: The primary resource. Complete every exercise and every extra mile challenge. Do each lab machine twice: once to understand the vulnerability chain, and a second time to write a clean automated exploit from scratch.
• PortSwigger Web Security Academy: The single best free resource for building foundational skills. Focus on SQL injection, authentication, access control, SSRF, file upload, path traversal, and deserialization labs. Complete labs without looking at solutions, then convert each to a non-interactive proof-of-concept script. Explore the full range of modules at the PortSwigger Web Security Academy.
• PentesterLab White Badge Path: Structured white-box labs closest to the exam format. According to the widely cited snoopysecurity OSWE-Prep GitHub repository, recommended PentesterLab courses include SQLi to Shell MySQL, SQLi to Shell Postgres, and XSS and MySQL FILE.
• Hack The Box: Select machines with source-code review angles supplement preparation, but most HTB content skews toward black-box testing rather than the white-box methodology OSWE requires.
• VulnHub Machines: The same community resource highlights SECURECODE and Cryptobank1 for additional white-box practice outside the official curriculum.

Lab Strategy That Works

Simply completing the WEB-300 labs is insufficient. Successful candidates follow a deliberate practice pattern:

• Build personal exploit scripts from scratch rather than copying course examples.
• Practice writing a professional report for each lab machine, including vulnerability analysis, exploitation steps, and remediation recommendations.
• Work through widely cited community resources such as the snoopysecurity OSWE-Prep GitHub repository, the 0xb120 OSWE preparation checklist², and detailed blog walkthroughs from z-r0crypt and BRM⁴ that include milestone matrices mapping specific exploitation skills to practice tasks.

Difficulty Compared to Other Certifications

Understanding where OSWE sits relative to adjacent credentials helps set expectations:

• OSWE vs OSCP: OSCP covers broader network exploitation across multiple hosts, while OSWE requires deeper single-domain expertise in code review. OSWE is narrower in scope but more technically demanding within its specialty.
• OSWE vs OSEP: OSEP focuses on evasion techniques and Active Directory attack paths. OSWE is web-only but far more code-intensive, requiring line-by-line source analysis rather than payload crafting.
• OSWE vs GWAPT: GWAPT is a knowledge-based multiple-choice exam testing conceptual understanding. OSWE is purely practical, requiring candidates to discover vulnerabilities in unfamiliar codebases and deliver working exploits within 48 hours.

The Web Application Hacker's Handbook and the OWASP Code Review Guide serve as essential reference texts throughout preparation², providing the conceptual foundation that exam scenarios assume you already possess.

OSWE vs OSCP vs OSEP vs GWAPT: Difficulty and Scope Compared

These four certifications are complementary specializations, not rungs on a single ladder. OSCP validates broad penetration testing fundamentals, OSWE zeroes in on web application exploitation through source-code review, OSEP extends into advanced evasion and post-exploitation, and GWAPT covers web app pentesting with a knowledge-based exam format. Choosing between them depends on your current role and the attack surface you want to master.

OSWE Salary Impact, Job Roles, and Employer Demand

Holding the OSWE signals deep, hands-on web application exploitation skills, and employers in consulting, financial services, technology, and government routinely list it as a preferred or required credential for senior application security roles. The salary data below draws on 2026 job-posting aggregates and federal wage statistics to show where OSWE holders typically land on the pay scale. Demand is strongest at organizations running bug-bounty programs, fintech platforms, and firms with large custom-application footprints that need source-code-level offensive testing.

Information Security Analyst Salaries by State

OSWE holders fall under the Bureau of Labor Statistics' Information Security Analysts occupation (SOC 15-1212), a category projected to grow 29% from 2024 to 2034, far outpacing the 3.1% average for all occupations. Nationally, salaries span a wide range depending on location, experience, and specialization. Professionals with advanced offensive security credentials like the OSWE typically command compensation in the upper quartile, especially in roles focused on web application penetration testing and source-code auditing.

Related Articles

Renewal, Continuing Education, and Expiration Policy

Some vendor certifications expire on a three-year clock and demand continuing education credits to stay valid. OffSec takes the opposite approach: once you pass the OSWE exam, the credential is yours permanently.

No Expiration, No Renewal Fees

The OSWE does not expire. There are no annual maintenance fees, no CPE (continuing professional education) tracking, and no re-testing requirements. Once OffSec issues your certificate and adds you to the credential verification registry, that record stands indefinitely. This is consistent across the OffSec portfolio, including OSCP, OSEP, and OSED.

That permanence is a real cost advantage over credentials like the CISSP Guide and the GIAC family, which can run several hundred dollars per year in maintenance fees over the life of your career.

What Employers Actually Expect

Lifetime validity does not mean employers treat a ten-year-old OSWE the same as a recent one. Web application attack surfaces evolve quickly: new frameworks, new authentication patterns, new deserialization vectors. Hiring managers for senior application security roles typically look for evidence that you have stayed sharp, not just that you passed WEB-300 once.

Practical ways to demonstrate currency:

• Stack credentials: Add OSEP (evasion and lateral movement) or OSED (exploit development) to show breadth beyond web.
• Contribute publicly: Publish CVE research, submit to bug bounty programs, or maintain open-source security tooling.
• Keep lab time active: Renew a WEB-300 lab subscription or use platforms like PortSwigger Web Security Academy and HackTheBox Pro Labs.

The Subscription Caveat

While the certificate itself is permanent, your WEB-300 course materials and lab access are subscription-bound. When your 90-day, 365-day, or Learn One term ends, lab connectivity and course content lock. Plan any post-exam review or teaching prep before the subscription window closes.

Best Alternatives and Next Credentials After OSWE

The OffSec Web Assessor serves as the most logical stepping stone toward the OSWE, giving candidates a controlled environment to test their readiness before committing to the white-box depth that OSWE demands. Understanding where each credential fits requires a broader view; use our Compare Cybersecurity Certifications Side by Side tool to sequence your professional development efficiently.

OSWA as the Natural On-Ramp

OffSec designed the OSWA specifically as the intermediate credential bridging foundational penetration testing skills and the advanced source-code exploitation techniques required for OSWE. The OSWA exam runs nearly 24 hours in a hands-on, proctored format¹ that mirrors the OSWE experience but focuses on black-box web assessment rather than white-box code analysis.

The OSWA costs $1,649 for the Learn One bundle that includes training and a single exam attempt, with retakes priced at $249.² This makes it a lower-risk investment for practitioners who want to validate their web testing methodology before spending on the more demanding OSWE track. Junior to mid-level web pentesters benefit most from OSWA, as the intermediate difficulty level³ builds confidence with realistic exploitation scenarios without requiring the code review expertise that OSWE presumes.

GIAC Web Application Penetration Tester

The GIAC Web Application Penetration Tester takes a different approach, validating similar web application penetration testing knowledge through a proctored multiple-choice exam rather than a practical lab. Enterprise and government-adjacent application security teams often prefer GWAPT because GIAC credentials carry strong recognition in compliance-driven environments where certification requirements are written into contract language.

The moderate-to-challenging difficulty level and structured exam format make GWAPT accessible to practitioners who prefer knowledge validation over time-pressured exploitation demonstrations. If your target employers operate in regulated industries or federal contracting spaces, GWAPT may carry more weight in hiring decisions than OffSec credentials.

ISC2 Certified Secure Software Lifecycle Professional

The CSSLP shifts the focus entirely from offensive testing to defensive secure development practices. This credential validates expertise across the entire software development lifecycle, from secure design principles through implementation, testing, deployment, and maintenance.

AppSec engineers, DevSecOps practitioners, and security architects pursuing leadership roles find CSSLP valuable because it demonstrates breadth across secure coding standards, threat modeling, and risk management. The proctored multiple-choice exam sits at a moderate difficulty level and appeals to professionals who want to complement offensive skills with demonstrated defensive knowledge.

Sequencing Your Credentials

For practitioners committed to offensive web specialization, the natural progression , consult our Cybersecurity Certification Roadmaps , moves from OSWA to OSWE, then potentially to the OffSec Experienced Penetration Tester for broader enterprise attack paths. Those building hybrid skill sets might pair OSWE with CSSLP to demonstrate both attack and defense capabilities. GWAPT serves well as a parallel credential when employer requirements or industry recognition factors favor GIAC over OffSec certifications.

Editorial Verdict by Learner Profile

As organizations migrate more critical logic to web applications, the ability to exploit and secure them at the code level has shifted from a niche skill to a core security competency. That shift sets the context for the OSWE, but not everyone is at the right place in their career to benefit from it. The decision to pursue this certification depends heavily on your current hands-on experience, not just your aspirations.

No IT Background

If you are starting from zero with no professional technology experience, the OSWE is not an appropriate first goal. The exam expects fluency in reading and modifying web application source code, chaining multiple vulnerabilities, and writing custom exploits. These skills are built on a foundation of operating systems, networking, scripting, and at least one modern web development stack. None of those areas are covered in OSWE training. A more realistic path starts with CompTIA Security+ to establish baseline security concepts, followed by the OSCP to build hands-on offensive skills. Only once you have worked as a penetration tester for a couple of years and can comfortably read and debug server-side code should you circle back to OSWE.

Early IT Professional (1, 2 Years)

If you are working a help desk role or a junior developer position, you are still in the skill-building phase. You likely do not yet have the depth of web application security testing experience needed to pass the OSWE exam. The certification assumes you can navigate codebases, identify logic flaws, and bypass authentication mechanisms without step-by-step guidance. A better intermediate step is the OSWA (OffSec Web Assessor) if you want to stay purely in web app territory, or the OSCP if you need a broader penetration testing foundation first. Spend time deliberately practicing on intentionally vulnerable applications like PortSwigger’s Web Security Academy or PentesterLab before committing to the OSWE’s significant financial and time investment.

Working Cybersecurity Practitioner (3+ Years, Holds OSCP or Equivalent)

This profile is the sweet spot for the OSWE. If you already earn a living as a penetration tester or security engineer and have completed the OSCP, the OSWE adds a high-value specialization that differentiates you from generalist pentesters. It signals to employers that you can move beyond scanner output and manual parameter tampering into source-code-assisted exploitation. The credential is especially valuable if you want to pivot into application security engineering, bug bounty hunting at a professional level, or consulting engagements that require white-box web assessments. Expect the exam to be a difficult but logical progression from your current skills.

Experienced Specialist or Manager (5+ Years, Multiple Certs)

At this stage, the OSWE is worth the time and cost only if your current or target role involves significant code review, AppSec consulting, or leading web application assessment teams. If your daily work focuses on network infrastructure, Active Directory exploitation, or red team operations, then OSEP or CRTO will align more directly with your cybersecurity career. For managers building an application security program, the OSWE can provide enough depth to evaluate technical reports and mentor junior staff without needing to become a full-time code auditor. Weigh the renewal and continuing education overhead against the direct value it brings to your specific responsibilities before enrolling.

Frequently Asked Questions

These are the most common questions from professionals considering the OSWE certification. Each answer draws on the exam details, costs, and career data covered earlier in this guide.