Security & Privacy
Surfshark's security stack is more impressive than its budget pricing might suggest. The default protocol is WireGuard, enhanced with post-quantum key encapsulation via Kyber -- a NIST-approved algorithm designed to resist attacks from quantum computers. This puts Surfshark ahead of most competitors in post-quantum readiness, which is increasingly relevant as harvest-now-decrypt-later attacks become a documented threat.
The encryption layer uses AES-256-GCM on OpenVPN and ChaCha20-Poly1305 on WireGuard. Both are industry-standard choices. IKEv2 remains available for iOS users who prefer it, though there is little reason to choose it over WireGuard in 2026.
The kill switch works across all major platforms, including Linux. Surfshark also provides DNS leak protection, IPv6 leak protection, and what they call Camouflage Mode -- obfuscation that makes VPN traffic look like regular HTTPS traffic. This is useful in restrictive network environments and countries with VPN restrictions. NoBorders Mode automatically activates in restricted regions, selecting servers optimized for censorship circumvention.
On the audit front, Deloitte has conducted two independent no-logs audits: one in 2023 and a follow-up in June 2025. Both confirmed that Surfshark does not log connection timestamps, IP addresses, bandwidth usage, or traffic data. The server infrastructure runs entirely on RAM -- no hard drives, no persistent storage. If a server is seized or rebooted, all data is wiped.
Merger context: Surfshark merged with Nord Security (parent of NordVPN) in 2022. The companies state that products remain separate and independent, with infrastructure shared only where mutually beneficial. Surfshark was originally incorporated in the Netherlands and now operates under Nord Security's structure (registered in Panama and Lithuania). For users who prioritize corporate independence, this is worth monitoring, though there is no evidence the merger has degraded Surfshark's privacy practices to date.
Speed & Performance
Surfshark's server network consists of 3,200+ servers across 100 countries, with all servers upgraded to 10 Gbps connections. The US alone has 790 servers, which is important given that a large portion of VPN traffic routes through American infrastructure for streaming and general browsing.
The standout speed feature is Nexus, Surfshark's software-defined networking (SDN) layer. Rather than treating each server as an isolated endpoint, Nexus connects the entire fleet into a single global network. This enables FastTrack, which optimizes routing paths between your device and the destination -- Surfshark claims 70% faster routing in some scenarios. In our testing, the improvement was noticeable on long-distance connections (US to Asia-Pacific, for example) but less dramatic on same-region connections where routing was already efficient.
WireGuard performance is solid. On nearby servers, expect 15-25% speed reduction from baseline -- competitive with other premium VPNs, though NordVPN's NordLynx (their WireGuard implementation) occasionally edges ahead in raw throughput. On distant servers, FastTrack routing helps close that gap.
One under-appreciated feature is Everlink, which automatically re-establishes VPN connections when they drop. On mobile devices switching between Wi-Fi and cellular, this prevents the brief unprotected windows that can occur with other VPNs. It is a small detail, but it reflects thoughtful engineering.
Features
Nexus SDN Technology
Nexus is Surfshark's most significant technical differentiator. Built on SDN principles borrowed from enterprise networking, it turns the server fleet into an interconnected mesh rather than a collection of discrete VPN servers. Three features run on top of Nexus:
- IP Rotator: Changes your visible IP address every 5 minutes without dropping the VPN connection. Useful for reducing tracking surface area.
- Dynamic MultiHop: Standard multi-hop VPNs use pre-selected server pairs. Surfshark lets you choose any entry and exit server combination, creating custom double-VPN routes. You can enter through a Tokyo server and exit through Zurich if your threat model requires it.
- FastTrack: Optimizes internal routing across the Nexus mesh, reducing latency on long-distance connections.
This is not marketing theater. SDN-based VPN architecture is a genuine advancement, and Surfshark is one of the few consumer VPNs implementing it at this level.
CleanWeb 2.0
CleanWeb operates in two modes. At the VPN level, it performs DNS-level blocking of known ad networks, malware domains, and trackers. This works across all apps and traffic on the device. The browser extension version goes further: it blocks YouTube ads, dismisses cookie consent popups, and strips tracking parameters from URLs. The DNS-level blocking is particularly effective because it catches ads and trackers that browser-based ad blockers miss -- specifically in mobile apps and smart TV interfaces.
Bypasser (Split Tunneling)
Bypasser lets you route specific apps or websites outside the VPN tunnel. This is essential for banking apps that flag VPN connections, local network printers, or services that require your real IP. Available on Windows, Android, and macOS (not iOS, due to Apple platform restrictions).
Alternative ID
Generates a pseudonymous identity -- name, email address, date of birth -- for use on sites where you do not want to share real information. The generated email address forwards to your real inbox. It is a privacy convenience tool rather than a security feature, but it reduces your data footprint across low-stakes sign-ups.
Ease of Use
Surfshark's apps are clean and straightforward. The interface follows a standard VPN layout: a prominent connect button, a searchable server list, and settings accessible through a gear icon. Auto-connect is available, and you can configure it to engage whenever you connect to untrusted networks.
The app covers Windows, macOS, Linux (with a GUI), iOS, Android, Fire TV, Apple TV, and browser extensions for Chrome and Firefox. Smart DNS is available for devices that cannot run VPN clients natively. Router support exists but requires manual configuration on most router firmware.
One area where Surfshark outperforms competitors: the Linux client has a full graphical interface. Most VPN providers offer only command-line tools for Linux. This matters for the growing number of Linux desktop users who want VPN protection without terminal commands.
Pricing
Surfshark structures its plans into four tiers: Starter, Starter+, One, and One+. All tiers support unlimited simultaneous connections -- every device you own, plus your family's devices, on a single subscription.
The monthly rate for Starter is $15.45/mo -- roughly 8x the 2-year price, which tells you how aggressively Surfshark prices long-term commitments. One monthly comes in at $17.95/mo, and One+ at $20.85/mo.
Here is what each tier includes:
- Starter: VPN, CleanWeb, Alternative ID, kill switch, split tunneling, MultiHop, unlimited devices
- One: Everything in Starter + Surfshark Antivirus, Surfshark Alert (breach monitoring), Surfshark Search (private search engine)
- One+: Everything in One + Incogni, which contacts data brokers to remove your personal information from 420+ databases
The uncomfortable truth about VPN pricing applies here: renewal rates jump significantly. After your initial term expires, Starter renews at $79/year, One at $99/year, and One+ at $119/year. Still reasonable, but substantially more than the introductory rate. Factor this into your cost calculation.
Value comparison: At $1.99/mo for the 2-year plan, Surfshark undercuts NordVPN ($3.09/mo) and ExpressVPN ($6.67/mo) while offering unlimited connections. NordVPN caps at 10 simultaneous devices; ExpressVPN at 8. For a household of 4-5 people, Surfshark's per-device cost is a fraction of the competition.
Who Is Surfshark Best For?
Surfshark occupies a specific and well-defined niche. It is the best choice for:
- Families and households: Unlimited connections means one subscription covers every phone, laptop, tablet, smart TV, and router in the house. No counting devices, no choosing who gets protected.
- Budget-conscious users who refuse to compromise on security: At $1.99/mo, you get post-quantum encryption, two independent audits, RAM-only servers, and a kill switch. That is a serious security stack at an entry-level price.
- Small teams and remote workers: Protect an entire team's devices without managing per-seat licensing. The Alternative ID feature is useful for signing up for vendor tools without exposing team email addresses.
- Privacy-focused users who want extras: The One+ tier bundles data broker removal (Incogni), breach monitoring, and private search into a single subscription. Buying these separately would cost more than the combined plan.
Surfshark is not the best choice if you need the largest possible server network for maximum location diversity (NordVPN wins there), if you need dedicated IPs on a basic plan, or if corporate independence from larger entities is a non-negotiable requirement for your threat model.
Testing Methodology
We evaluated Surfshark across five categories using standardized criteria applied to all VPN reviews:
- Security & Privacy (30%): Protocol strength, encryption standards, kill switch reliability, audit history, logging policy, jurisdiction analysis
- Speed & Performance (25%): Throughput testing on WireGuard across 10 server locations, latency measurements, consistency over 7-day testing period
- Features (20%): Breadth and quality of features, platform availability, unique differentiators (Nexus, CleanWeb), streaming/unblocking capability
- Ease of Use (10%): App design, setup complexity, platform coverage, documentation quality
- Value (15%): Price relative to feature set, connection limits, renewal pricing transparency
Tests were conducted from US East Coast infrastructure using residential ISP connections. Speed tests used Ookla Speedtest CLI against consistent server targets. Streaming tests verified access to Netflix US, Disney+, HBO Max, BBC iPlayer, and Amazon Prime Video.
Final Verdict
The best value in VPNs, with serious security to back it up
Surfshark earns its 8.5/10 by delivering premium security features -- post-quantum encryption, Deloitte-audited no-logs policy, RAM-only servers -- at a price that makes it accessible to everyone. The unlimited connections policy alone would justify consideration, but combine it with Nexus SDN technology, CleanWeb 2.0, and the most aggressive pricing in the premium VPN market, and you get a product that punches well above its price point. The smaller server network and merger-related ambiguity on jurisdiction keep it a half-step behind NordVPN overall, but for most users, the value proposition is hard to argue with.
Get Surfshark -- From $1.99/mo →