TryHackMeRoadmap: 378 free rooms sorted by topic

A list, and only a list

TryHackMeRoadmap contains two files, README.md and Roominfo.md. That is the entire repository. There is no code, no tool, no configuration and no licence file, and the primary language of the project is not recorded.

What the README holds is a curated list of 350+ free TryHackMe rooms, which the table of contents totals at 378. The framing is educational rather than offensive: the description says the rooms simulate real world scenarios, and the room list is meant to help someone dive into network security, penetration testing and web application hacking.

The stated reason for the list is the one that matters. With this curated selection you will not need to sift through countless rooms to find relevant learning paths. The list makes it easier to start, progress and complete targeted cybersecurity training.

That is a curation problem, and curation is a legitimate thing for a repository to be. TryHackMe has hundreds of free rooms and no obvious ordering beyond its own filters, so a maintained list that groups them by subject and gives a count per topic saves a beginner from the hardest available room on a subject they have never touched.

It also sets a clear boundary on expectations. Nothing here teaches you anything on its own. Each room is self-contained, with step-by-step instructions, challenges and hints, and it is the room that does the teaching. The repository is the map, and the map is worth having.

Twenty six topics, and where the weight sits

The table of contents in the README lists 26 topics with a room count for each, and the distribution is informative.

The foundations are small. Introductory Rooms hold 10 entries, Linux Fundamentals 5, Windows Fundamentals 3 and Basic Rooms 9. Linux Fundamentals is the only section with its completed rooms column filled in, at 5 of 5, which tells you the maintainer works through the list as well as curating it.

The middle of the table is where a working offensive skill set lives. Reconnaissance has 10 rooms, Scripting 8, Networking 7, Tooling 17, Crypto and Hashes 5, Steganography 6, Web 27, Android 1, Forensics 5, WiFi Hacking 1, Reverse Engineering 11, Malware Analysis 7, Privilege Escalation 13, Windows 7, Active Directory 5, PCAP Analysis 4 and Buffer Overflow 4.

The CTF sections dominate by count. Easy CTF holds 58 rooms, Medium CTF 73, Hard CTF 38 and Misc 35, with Special Events at 9. Together the four CTF sections account for 204 of the 378 rooms, which is the clearest signal in the whole list about what the community actually does on TryHackMe.

The topic counts also show where the platform is thin. Android has one room and WiFi Hacking has one, so a learner whose interest is in either will find this list of limited use and will have to look elsewhere.

The last section before the total is Special Events, which in a list that is otherwise organised by subject is the one category whose membership changes with the calendar rather than with the curriculum.

Checkboxes, links and a completion column

The formatting is a GitHub-flavoured Markdown checklist, and every entry is a link to a room on tryhackme.com. The introductory section shows the shape:

- [ ] [TryHackMe | Welcome](https://tryhackme.com/room/hello)
- [ ] [TryHackMe | How to use TryHackMe](https://tryhackme.com/room/howtousetryhackme)

The unchecked box is the progress marker. A reader can tick rooms off in the file as they complete them, and a pull request to tick one is a small, easy contribution that the project can absorb without a review burden. The Linux Fundamentals section shows the pattern with the boxes filled in.

The links themselves are plain room URLs on tryhackme.com, which is worth noting because room slugs change. A list of links is a list of links that can rot, and the README's own claim is that the list will be updated as new rooms are released on TryHackMe, ensuring it stays a relevant tool for ongoing learning.

The completion column in the table of contents is a slightly different mechanism. It is a summary count of completed rooms per topic, and it is filled in for exactly one topic in the visible table. That is a manual bookkeeping exercise, which is the weakest part of the design: the count can drift from the checkboxes, and nothing in the repository describes a rule for keeping the two in sync.

The second file, Roominfo.md, is the counterpart to the checklist. It presumably carries the per-room detail that would make the README unreadable, and the README points at it as the place where the room information lives.

What TryHackMe actually is, and why the list is needed

The value of this repository depends on understanding what it sits on top of.

TryHackMe rooms are guided, hands-on exercises that run in a browser against a target machine the platform provides. The README describes them as offering step-by-step instructions, challenges and hints, with a practical way to learn and apply new skills.

That is the difference from a video course or a book. A room is an environment, not a document. You type commands into a machine, you break something, you read the hint, you go back. The learning happens in the doing.

The list then solves the problem that a large catalogue creates. When a platform has hundreds of free rooms spread across network security, forensics, web exploitation, Active Directory and CTF categories, a beginner cannot tell which room teaches the prerequisite for which, and the platform's own difficulty filters do not encode a curriculum. Ordering them by topic, with a suggested starting point in the introductory section, is a real service.

The topics listed in the README map onto the standard offensive security curriculum. Linux and Windows fundamentals first, then the tool skills (Reconnaissance, Tooling, Scripting, Networking), then the application layer (Web), then the exploitation depth (Privilege Escalation, Buffer Overflow, Reverse Engineering, Malware Analysis), then the domain skills (Active Directory, PCAP Analysis, Forensics, Steganography, Cryptography), with the CTF sections standing on their own as difficulty-graded challenge sets.

The list also encodes a defensible view of what a working security practitioner needs. The heavy topics by count are Web, Privilege Escalation, Tooling, Reconnaissance and the CTF tiers, which says something about where the practice is.

Why a static list ages badly, and what to do about it

The honest limitation of this project is that its value decays with time in a way the README does not really address.

First, the links. TryHackMe regularly retires rooms, renames them and changes their difficulty. A room that was free when the list was written can become a subscriber-only room, and a room URL can change without warning. The README's promise of regular updates is a promise, and the last push was on 2026-08-30, so the list is current to roughly that point and not beyond it.

Second, the shape of the platform. The list says the rooms are free, but TryHackMe's free tier is not unlimited, and the definition of free is not in the repository. Rooms on the platform change status, and a list that does not record that status will point you at a paywall or a retired room without warning.

Third, the difficulty model. The topic sections are organised by subject and the CTF sections by difficulty, but within a topic section the rooms are not sorted from easy to hard. A learner picking up the Web section will meet a room that assumes Active Directory knowledge in a section they reached from the top of the page. The ordering is a map, not a path with prerequisites marked.

Fourth, the completion tracking. Checkboxes in a README are a poor progress store. There is no tooling to sync them, so a learner using this across several devices keeps their state wherever they last edited the file, and the completion column in the table of contents can disagree with the checkboxes without anyone noticing.

None of this makes the list bad. It makes it a snapshot, and using it well means treating it as one: check the room exists and is still free before you plan around it, and use the topic order to decide what to study next rather than assuming the rooms inside a topic are sequenced.

The alternative paths to the same rooms

There are two other routes to the same content, and they differ in approach from what this repository does.

The first is the platform's own structure. TryHackMe ships Learning Paths, which are curated multi-room sequences assembled by the platform with a defined order and a stated goal, and it also has its own difficulty and topic filters. That is the difference in approach: a learning path is authored and maintained by the platform as a course with a beginning and an end, while this list is a taxonomy, a map with counts rather than a course. The platform's version is better as a curriculum. This version is better as a survey of what exists across a topic, including the free rooms you would not find if you only followed the platform's paths.

The second is a learning platform that is not a browser-based lab. A range of commercial and academic training providers offer structured curricula in the same subjects, Active Directory and web exploitation among them, with the difference that they provide their own lab infrastructure, more realistic scenarios and in some cases certification alignment. What you pay for there is the environment and the feedback, not the topic list.

There is a third option worth naming, which is the opposite of a curated list. A learner who already knows the shape of the field can pick the two or three areas they need, search the platform for those topics and work through what comes up, using this list only as a cross-check that nothing obvious was missed.

The most useful framing for the whole project is that it is a compression of a large public catalogue into a scannable table. That compression is worth something exactly as long as the catalogue behind it stays stable and free, which is a condition the maintainer does not control and the README does not guarantee.

Editorial conclusion

Adopt TryHackMeRoadmap when you are choosing what to study next on TryHackMe and want a curriculum rather than a search box, and treat the topic order as the curriculum. Do not adopt it as a self-contained course, since every room lives on TryHackMe and needs an account, and do not treat its numbering as a difficulty score, because the three CTF sections are grouped by challenge difficulty while the topic sections are grouped by subject. Before you start, read Roominfo.md alongside the README, count what you have already finished against the completed rooms column, and remember that the last push was on 2026-08-30, so check that the rooms you plan to work through are still free and still available.

Frequently asked questions

Official sources

1. Issues
2. README
3. uttambodara/TryHackMeRoadmap on GitHub