Roadmaps

Learning roadmaps

Step-by-step paths into computer science, in the order I would learn them again. Every resource is free and comes from a university, an official project or a respected non-profit.

Free resources only, links checked every week

How to use these roadmaps

  1. New to programming? Start with Foundations. Every other path builds on it.
  2. Pick one path and follow the stages in order. Jumping between paths is the most common reason people feel lost.
  3. Build the project at the end of each stage. Watching courses feels like progress, but the project is what proves you can do it.
  4. Times assume about 10 hours a week. Going slower is fine; skipping the projects is not.
Certification roadmapsWhich certifications to take for each career, with real costs. Cybersecurity & AI security roadmapsA career roadmap for each area of security, from Beginner to Expert, with labs, tools and certifications.

Foundations of computer science

Programming, the tools every developer uses, data structures, and how computers and networks really work.

Time
31–40 weeks
Leads to
Every other path

Anyone starting out, or anyone who learnt to code from tutorials and has gaps.

  1. Stage 1: Learn to program 6–8 weeks

    What to learn

    • Variables, conditions and loops
    • Functions
    • Lists and dictionaries
    • Reading error messages
    • Debugging

    Free resources

    Build: A small command-line program you design yourself, such as an expense tracker that saves to a file.

    Move on when: You can write a 100-line program without following a tutorial.

  2. Stage 2: The terminal, Git and Linux 3–4 weeks

    What to learn

    • Shell commands and pipes
    • Files and permissions
    • Git commits, branches and merges
    • GitHub
    • A code editor

    Free resources

    Build: Put every program you have written on GitHub, each with a short README.

    Move on when: You can work in the terminal without a mouse and fix a merge conflict.

  3. Stage 3: Data structures and algorithms 8–10 weeks

    What to learn

    • Big-O notation
    • Arrays, linked lists, stacks and queues
    • Hash tables
    • Trees and graphs
    • Sorting, searching and recursion

    Free resources

    Build: Write your own hash table and a graph search (BFS and DFS), with tests.

    Move on when: You can explain why a dictionary lookup is fast and choose the right structure for a problem.

  4. Stage 4: How computers and networks work 8–10 weeks

    What to learn

    • Logic gates to CPU
    • Memory and processes
    • Operating systems
    • TCP/IP, DNS and HTTP
    • Concurrency basics

    Free resources

    Build: A tiny web server written with raw sockets that serves a page to your browser.

    Move on when: You can explain everything that happens between typing a web address and seeing the page.

  5. Stage 5: Math and databases 6–8 weeks

    What to learn

    • Logic and proofs
    • Sets, counting and probability
    • Relational databases
    • SQL queries and joins
    • Designing tables

    Free resources

    Build: Design a database for a small library or shop and answer 20 questions about it in SQL.

    Move on when: You can write a query with joins and grouping, and reason about a simple probability.

Back to all paths

Web development

Build websites and web apps, from the page people see to the server and database behind it.

Time
28–38 weeks
Before this
Foundations of computer science
Leads to
Front-end developer, Back-end developer, Full-stack developer

People who want to build things others can use right away, in a browser.

  1. Stage 1: HTML, CSS and how the web works 4–6 weeks

    What to learn

    • Semantic HTML
    • Accessibility
    • CSS layout with flexbox and grid
    • Responsive design
    • Browser developer tools

    Free resources

    Build: A personal page that works on a phone and passes an accessibility check.

    Move on when: You can rebuild the layout of a site you like from scratch.

  2. Stage 2: JavaScript in depth 6–8 weeks

    What to learn

    • The DOM and events
    • Functions, closures and objects
    • Promises and async/await
    • Fetching data from APIs
    • Modules

    Free resources

    Build: An app that uses a public API, such as a weather or book search app.

    Move on when: You can build an interactive page without a framework.

  3. Stage 3: A front-end framework and TypeScript 6–8 weeks

    What to learn

    • Components and state
    • Forms and validation
    • Routing
    • TypeScript types
    • Testing components

    Free resources

    Build: A multi-page app with forms, saved state and at least a few tests.

    Move on when: You can explain when a component re-renders and why.

  4. Stage 4: Back end and databases 8–10 weeks

    What to learn

    • HTTP in detail
    • Building REST APIs
    • Login, sessions and tokens
    • PostgreSQL
    • Automated tests

    Free resources

    Build: An API with user accounts and a database, with tests, used by your front end.

    Move on when: You can design an API, store data safely, and test it.

  5. Stage 5: Ship it, safely 4–6 weeks

    What to learn

    • Deploying an app
    • Environment variables and secrets
    • HTTPS
    • Continuous integration
    • The OWASP Top 10

    Free resources

    Build: Deploy your full app with automatic tests on every push, and check it against the OWASP Top 10.

    Move on when: Strangers can use your app and you would know if it broke.

Back to all paths

Cybersecurity

Understand how systems are attacked so you can defend them: networks, web apps, detection and response.

Time
30–38 weeks + Ongoing
Before this
Foundations of computer science
Leads to
SOC analyst, Penetration tester, Security engineer, AI security researcher

Curious people who like taking things apart and want to protect people and systems.

Only test systems you own or have written permission to test. Use the practice labs below; attacking other systems is illegal almost everywhere.

  1. Stage 1: Networking and Linux for security 6–8 weeks

    What to learn

    • The TCP/IP model and common ports
    • DNS, HTTP and TLS on the wire
    • Reading traffic in Wireshark
    • Linux users, permissions and logs
    • Shell scripting

    Free resources

    Build: Capture your own browsing in Wireshark and write a short explanation of what each part of the traffic is.

    Move on when: You can read a packet capture and say what happened, and you have finished most of OverTheWire Bandit.

  2. Stage 2: Security fundamentals 6–8 weeks

    What to learn

    • Confidentiality, integrity and availability
    • Authentication and access control
    • Hashing, encryption and certificates
    • Common attacks and malware
    • Risk and security frameworks

    Free resources

    Build: A one-page threat model for an app you built: what could go wrong, how likely it is, and what you would fix first.

    Move on when: You can explain how TLS protects a login and why passwords are hashed, not encrypted.

  3. Stage 3: Web application security 8–10 weeks

    What to learn

    • SQL injection
    • Cross-site scripting
    • Broken access control
    • Authentication flaws
    • Server-side request forgery
    • Using Burp Suite

    Free resources

    Build: Find and write up at least ten vulnerabilities in OWASP Juice Shop, including how to fix each one.

    Move on when: You can explain, exploit in a lab, and fix each class in the OWASP Top 10.

  4. Stage 4: Pick a side: defend or attack 10–12 weeks

    What to learn

    • Defence: logs, SIEM and alert triage
    • Defence: incident response
    • Attack: reconnaissance and exploitation
    • Attack: privilege escalation
    • Both: MITRE ATT&CK
    • Both: writing clear reports

    Free resources

    Build: Defence: a home lab that collects logs and detects three ATT&CK techniques. Attack: solve 20 picoCTF challenges and publish write-ups.

    Move on when: You can show your lab or write-ups to an employer and talk through your reasoning.

  5. Stage 5: Specialise and keep up Ongoing

    What to learn

    • Cloud security
    • AI and LLM security
    • Malware analysis
    • Governance, risk and compliance
    • Following advisories

    Build: Publish something others can use: a write-up, a detection rule, or a small tool.

    Move on when: This stage never ends. Security changes every month.

Certification roadmaps Back to all paths

AI and machine learning

From the math behind learning to training models, working with language models, and putting them into use responsibly.

Time
35–44 weeks + Ongoing
Before this
Foundations of computer science
Leads to
Machine learning engineer, Data scientist, AI researcher, MLOps engineer

People comfortable with programming who enjoy math and experiments.

  1. Stage 1: Math for machine learning 6–8 weeks

    What to learn

    • Vectors and matrices
    • Derivatives and gradients
    • Probability
    • Statistics
    • Optimisation

    Free resources

    Build: Implement linear regression with gradient descent using only NumPy, and plot the loss going down.

    Move on when: You can explain gradient descent on a whiteboard.

  2. Stage 2: Python for data 3–4 weeks

    What to learn

    • NumPy arrays
    • pandas data frames
    • Cleaning messy data
    • Plotting
    • Jupyter notebooks

    Free resources

    Build: Clean and explore a public dataset, and write down three things you found.

    Move on when: You can load, clean and summarise a dataset you have never seen.

  3. Stage 3: Classical machine learning 8–10 weeks

    What to learn

    • Training, validation and test sets
    • Overfitting and regularisation
    • Regression and classification
    • Decision trees and ensembles
    • Choosing the right metric

    Free resources

    Build: A model trained end to end, tested on data it never saw, with an honest note on where it fails.

    Move on when: You can tell when a good score is really data leakage.

  4. Stage 4: Deep learning 10–12 weeks

    What to learn

    • Neural networks and backpropagation
    • PyTorch
    • Convolutional networks
    • Transformers and attention
    • Training on a GPU

    Free resources

    Build: Train an image or text classifier and compare it with the classical model from the last stage.

    Move on when: You can build and debug a training loop yourself.

  5. Stage 5: Language models 8–10 weeks

    What to learn

    • Tokens and embeddings
    • How large language models are trained
    • Fine-tuning
    • Retrieval-augmented generation
    • Evaluating outputs

    Free resources

    Build: A question-answering app over your own notes, with a small test set to measure how often it is right.

    Move on when: You can explain why a model gave a wrong answer and measure whether a change helped.

  6. Stage 6: Put models into use, responsibly Ongoing

    What to learn

    • Serving a model behind an API
    • Monitoring and data drift
    • Bias and fairness
    • Privacy
    • Attacks on AI systems

    Free resources

    Build: Deploy one of your models with monitoring and a short model card that says what it should not be used for.

    Move on when: This stage never ends. Keep shipping and measuring.

Certification roadmaps Back to all paths

Data analysis and engineering

Turn raw data into answers people can act on, and build the pipelines that keep that data flowing.

Time
27–36 weeks
Before this
Foundations of computer science
Leads to
Data analyst, Analytics engineer, Data engineer

People who like asking questions and finding the answer in numbers.

  1. Stage 1: SQL in depth 4–6 weeks

    What to learn

    • Filtering and sorting
    • Joins
    • Grouping and aggregates
    • Subqueries
    • Window functions

    Free resources

    Build: Answer 15 real questions about a public dataset using only SQL.

    Move on when: You can answer most business questions with one well-written query.

  2. Stage 2: Statistics 6–8 weeks

    What to learn

    • Averages, spread and distributions
    • Sampling
    • Confidence intervals
    • Hypothesis tests and A/B tests
    • Correlation is not causation

    Free resources

    Build: Analyse an A/B test dataset and write the conclusion in plain language for a manager.

    Move on when: You can say how sure you are of a result, not just what the result is.

  3. Stage 3: Analysis with Python or R 6–8 weeks

    What to learn

    • Loading and cleaning data
    • Tidy data
    • Reshaping and joining tables
    • Notebooks and reports
    • Reproducible work

    Free resources

    Build: A full report that starts from messy raw data and anyone can re-run.

    Move on when: You can go from a raw file to a clear answer in an afternoon.

  4. Stage 4: Visualisation and storytelling 3–4 weeks

    What to learn

    • Choosing the right chart
    • Honest axes and scales
    • Colour and accessibility
    • Dashboards
    • Writing a clear summary

    Free resources

    Build: A dashboard or one-page report that a non-technical person understands without your help.

    Move on when: Your charts answer a question at a glance.

  5. Stage 5: Data engineering 8–10 weeks

    What to learn

    • ETL and ELT pipelines
    • Data warehouses
    • Scheduling and orchestration
    • Transformations with dbt
    • Big data with Spark

    Free resources

    Build: A scheduled pipeline that pulls data from an API, stores it in a warehouse and feeds your dashboard.

    Move on when: Your pipeline runs on its own and tells you when it fails.

Certification roadmaps Back to all paths

Cloud and DevOps

Run software reliably: servers, containers, automation, cloud platforms and keeping things up.

Time
30–40 weeks
Before this
Foundations of computer science
Leads to
DevOps engineer, Cloud engineer, Site reliability engineer, Platform engineer

People who like making systems faster, safer and automatic.

  1. Stage 1: Linux and networking for operations 6–8 weeks

    What to learn

    • Processes and services
    • SSH and keys
    • Shell scripting
    • DNS, load balancers and firewalls
    • Reading logs

    Free resources

    Build: Set up a Linux server, lock down SSH, and host a site on it with HTTPS.

    Move on when: You can find out why a server is slow or a site is down.

  2. Stage 2: Containers 4–6 weeks

    What to learn

    • Images and containers
    • Writing a Dockerfile
    • Volumes and networks
    • Docker Compose
    • Building apps that are easy to run anywhere

    Free resources

    Build: Package a web app and its database with Docker Compose so it starts with one command.

    Move on when: Anyone can run your app on their machine in one step.

  3. Stage 3: Automation: CI/CD and infrastructure as code 6–8 weeks

    What to learn

    • Pipelines that test and build
    • Automatic deploys
    • Terraform
    • Managing secrets
    • Rolling back safely

    Free resources

    Build: A pipeline that tests, builds and deploys on every push, with the infrastructure written in Terraform.

    Move on when: You can rebuild your whole setup from code.

  4. Stage 4: One cloud platform, properly 6–8 weeks

    What to learn

    • Compute and storage
    • Identity and access (IAM)
    • Virtual networks
    • Managed databases
    • Costs and budgets

    Free resources

    Build: Deploy your app to one cloud with least-privilege access and a budget alert.

    Move on when: You can explain your cloud bill and who can access what.

  5. Stage 5: Kubernetes and reliability 8–10 weeks

    What to learn

    • Pods, deployments and services
    • Monitoring and alerts
    • Service level objectives
    • Incident response
    • Post-mortems

    Free resources

    Build: Run your app on a local Kubernetes cluster with monitoring and a dashboard for its service level objective.

    Move on when: You know when your service is unhealthy before your users do.

Certification roadmaps Back to all paths

Why you can trust these links

I only list resources that are free to use, written by universities, the people who make the tool, or long-running non-profits. No affiliate links and no paid bootcamps. Some university courses are free to watch but charge for a certificate; those are marked. A script checks every link once a week.

Last reviewed:

Found a broken link, or want a path added? Contact