Surfshark Review 2026

Surfshark is a VPN service founded in 2018 and run by Surfshark B.V., a company in Amsterdam, the Netherlands. This review covers its privacy record, security features, apps and prices, using the figures Surfshark publishes itself, its public audit reports, and one other site’s tests, credited to that site. We have not run our own speed or streaming tests, so this review makes no claims about either.

Surfshark at a glance

Surfshark at a glance

Servers

4,500+surfshark.com/servers · checked 2026-11-08

Countries

100surfshark.com/servers · checked 2026-11-08

Devices per plan

Unlimitedsurfshark.com/features/multiple-devices · checked 2026-11-07

Money-back

30 dayssurfshark.com/features/multiple-devices · checked 2026-11-07

Jurisdiction

Netherlandssurfshark.com/features/no-logs · checked 2026-11-09

Owner

Surfshark, founded in 2018 by Vytautas Kaziukonis. Surfshark says that in 2022 it and Nord Security "merged under one holding company" and that the two operate independentlysurfshark.com/about-us · checked 2026-11-09

Latest audit

2026Cure53 · infrastructure and the Dausos protocol (public summary)surfshark.com/media/NOR-29-summary.pdf · checked 2026-11-09

RAM-only servers

Yes. Surfshark says it runs 100% RAM-only servers and that all data is wiped when a server restartssurfshark.com/trust-center · checked 2026-11-09

Protocols

Automatic (default, usually picks WireGuard), WireGuard, OpenVPN, IKEv2 (removed from the Windows app; manual setup through the system settings), Dausos (Surfshark's own protocol, macOS app only for now)surfshark.com/features/surfshark-vpn-proto… · checked 2026-11-09

Logging policy

Says it does not log IP addresses, browsing history, session information, traffic or connection timestamps; keeps your email address, encrypted password, billing information and order history, and the minimal connection data needed to keep the service running and fix performance problemssurfshark.com/features/no-logs · surfshark.com/trust-center · checked 2026-11-09

Lowest price

$2.49/moUS prices; prices and currencies vary by countryStarter, 27 monthssurfshark.com/pricing · checked 2026-11-08

Price and refunds

Surfshark prices

Plan	First term	Per month	First term total	Then renews at
Starter	27 months	$2.49	$67.23	—
One	27 months	$2.491	$67.23	—
One+	27 months	$3.99	$107.73	—

US prices; prices and currencies vary by country.

Surfshark sells three tiers: Starter, One and One+. The prices in the table are for the first term of the long plan, which Surfshark sells as two years with extra months added. Surfshark’s pricing page showed the first-term price and the total, but the renewal price was not shown on the pricing page when we checked, so the table has no renewal figure for these plans. Treat the first-term price as temporary: look for the renewal terms at checkout before you pay, and put a reminder in your calendar a few weeks before the first term ends.

Sale prices change often, especially around Black Friday. Our editors re-check each offer, and an offer with no stated end date comes off this page a week after its last check until we have checked it again. If the table shows “Re-verifying”, that is the reason.

Surfshark has no permanent free plan. Its free trial lasts a week and is offered on the one-year and two-year plans only. To start it you give an email address and a payment method (a credit card, PayPal or Apple Pay), and during the trial you can connect only a few devices rather than an unlimited number. The trial turns into the paid plan you chose automatically when it ends, so cancel before then if you do not want to be charged. The money-back guarantee in the card above is the second way to try the service.

Privacy: who runs it and what it logs

Surfshark was founded in 2018 by Vytautas Kaziukonis. The service is run by Surfshark B.V. in Amsterdam, so it operates under Dutch law. Surfshark says that in 2022 it and Nord Security, the company behind NordVPN, “merged under one holding company”, and that the two continue to operate independently. Surfshark does not describe Nord Security as its parent company, and we have no source that says more about the holding company than that.

Surfshark says it does not log your IP address, browsing history, session information, traffic or connection timestamps. Surfshark says it does keep your email address, your encrypted password, your billing information and order history, and the small amount of connection data it needs to keep the service running and to fix performance problems. Outside firms have checked the policy and the systems behind it:

1. 2026Cure53 · infrastructure and the Dausos protocol (public summary)surfshark.com/media/NOR-29-summary.pdf · checked 2026-11-09
2. 2025Deloitte Lietuva · no-logs policy: ISAE 3000 (Revised) reasonable assurance, assessed as of 10 June 2025 (fieldwork 14 May to 10 June 2025). In scope: VPN servers (standard, static IP, MultiHop and multi-port), server configuration, the related APIs and the software-defined network. Out of scope: streaming infrastructure, captcha, most web and API services, and physical securitysurfshark.com/wp-content/uploads/2025/06/I… · checked 2026-11-09
3. 2025SecuRing · infrastructure penetration test. Surfshark says it found no critical or high-severity issues; one server SSL/TLS configuration issue and one best-practice recommendation, both since addressedsurfshark.com/blog/surfshark-securing-infr… · surfshark.com/media/SurfShark-Infrastructu… · checked 2026-11-09
4. 2025SecuRing · security assessment of the web, desktop and mobile apps and the browser extensions (attestation letter)surfshark.com/media/attestation_letter_202… · checked 2026-11-09
5. 2023Deloitte · no-logs policy (ISAE 3000)surfshark.com/trust-center · checked 2026-11-09
6. 2021Cure53 · infrastructure (public summary)surfshark.com/wp-content/uploads/2021/05/S… · checked 2026-11-09
7. 2018Cure53 · browser extensions (penetration test report)cure53.de/pentest-report_surfshark.pdf · checked 2026-11-09

The 2025 Deloitte report is the strongest item on the list, because the report itself is public and states its scope. Deloitte gave reasonable assurance, under an international assurance standard, on the setup as it stood on one day in June 2025. The work covered the VPN servers, including static IP, MultiHop and multi-port servers, their configuration, the related APIs and the software-defined network. The streaming infrastructure, captcha, most web and API services and physical security were outside the scope. For the 2023 Deloitte assurance we can confirm only what Surfshark’s own pages say: the year and that it covered the no-logs policy.

SecuRing and Cure53 did a different kind of work. Their tests look for security flaws in the infrastructure, the apps, the browser extensions and, in 2026, Surfshark’s new Dausos protocol. Surfshark says SecuRing’s 2025 infrastructure test found no critical or high-severity issues. Audits like these check a service at the time the auditor looked; they do not prove what happens between audits.

Security features

Surfshark’s apps choose a protocol automatically by default, and Surfshark says that choice is usually WireGuard. You can also pick WireGuard or OpenVPN yourself. IKEv2 has been removed from the Windows app, though it can still be set up by hand in the system settings. Dausos is Surfshark’s own newer protocol; for now it is in the macOS app only, and Cure53 examined it in 2026.

The kill switch blocks your internet connection if the VPN drops, so your real IP address is not exposed while the app reconnects. Surfshark lists it for Android, iOS, macOS, Windows and Linux. Two gaps matter. On Linux, the Snap and .deb packages have it and the Flatpak package does not. On Fire TV, the app for Vega OS does not have it; Surfshark lists it as “coming soon” with no date.

Surfshark says all of its servers are RAM-only: server data is held in memory and wiped when a server restarts, which limits what a seized or compromised server could reveal.

Split tunneling, which Surfshark calls Bypasser, lets you choose what skips the VPN, for example a banking app that blocks VPN addresses. Bypasser is in the Windows, macOS, Android and iOS apps. On iOS it can exclude websites but not apps. The reverse mode, where only the apps you pick use the VPN, is on Android only, and the browser extensions can exclude websites only.

Security incidents

1. 2026According to Surfshark's incident report of 9 September 2026, an internal test server was reachable from the public internet because of a human configuration error, and an unauthorized third party accessed it. That party reached some internal engineering material (some system binaries and the internal configuration of certain services) and some internal build credentials that had been committed to code history, and got into an isolated server (a VPS) used as a proxy. Surfshark found signs of this on 31 August, classed it as a security incident on 2 September and contained it the same day. Surfshark says user data and the VPN service were not affected, that production credentials are stored separately and were not affected, that its apps and extensions were not tampered with, and that the credentials involved have been rotated or disabled. The investigation was carried out by the company itself. Surfshark says it will commission another independent security audit; we had seen no result as of 9 November 2026.surfshark.com/blog/security-update-septemb… · checked 2026-11-09

The facts come from Surfshark’s own incident report. An internal test server could be reached from the public internet because of a configuration mistake, and an outsider got in. That person reached some internal engineering material, some build credentials that had been left in code history, and a separate server used as a proxy. Surfshark saw the first signs on the last day of August, classed the matter as a security incident two days later, and says it contained it the same day.

Surfshark says user data and the VPN service were not affected, that production credentials are stored separately and were not touched, that its apps and extensions were not tampered with, and that the credentials involved have been rotated or disabled. Those statements are Surfshark’s own. The investigation was carried out inside the company, and no outside firm has yet confirmed its findings. Surfshark says it will commission another independent security audit; when we last checked, no result had been published. We will add the outcome here when it appears.

Server network

The server and country counts in the card above are Surfshark’s own figures. Besides standard servers, the network includes static IP servers, which give you the same address each time, and MultiHop servers, which route your connection through two locations. Both kinds were in the scope of the 2025 Deloitte report.

For what Surfshark offers in a particular country, see our country guides:

• Surfshark’s servers in the US
• Surfshark’s servers in the UK
• Surfshark’s servers in Canada
• Surfshark’s servers in Australia
• Surfshark’s servers in Germany
• Surfshark’s servers in France
• Surfshark’s servers in Japan
• Surfshark’s servers in Singapore
• Surfshark in India
• Surfshark in South Korea

Apps and devices

Surfshark has apps for Windows, macOS, Linux, Android and iOS, TV apps for Fire TV, Apple TV and Android TV, and browser extensions for Chrome, Firefox and Edge. Devices with no app, such as a games console, can be covered by setting the VPN up on a router by hand. One subscription covers an unlimited number of devices, so you do not have to count phones, laptops and TVs.

The apps are not identical:

• Fire TV: Fire TV devices run either Fire OS or Vega OS, and Surfshark has a separate app for each; both are in the Amazon Appstore. The Vega OS app has no kill switch. To see which system your device runs, open Settings > My Fire TV > About.
• Linux: the Snap and .deb packages include the kill switch; the Flatpak package does not.
• iPhone and iPad: Bypasser can exclude websites but not apps.
• Windows: IKEv2 is no longer in the app.
• Mac: the macOS app is the one place where you can try the Dausos protocol.
• Browser extensions: an extension protects the browser’s own traffic, not other apps on the same computer, so on a laptop the desktop app is the better choice.

Streaming, torrenting and speed

We have not run our own speed or streaming tests yet. This is where our results will appear, with the date and setup of each run:

Our spot checks of Surfshark

Our spot check	Result
Streaming playback on a US server	No spot check yet

A spot check is our own: run in the US on a US server, five minutes of continuous playback to pass, with no fixed schedule. Results for other countries come from other sites' published tests.

Until then, below is what we know, followed by what one other review site measured; use the free trial or the refund period to check the services you care about.

• Streaming: we have not tested which streaming services or regions work with Surfshark, and streaming services block VPN addresses from time to time. The streaming infrastructure was also outside the scope of the 2025 no-logs report.
• Torrenting: we found no third-party torrenting test from the last twelve months. Check the copyright rules where you live; a VPN does not change what is legal.
• Speed: we make no speed claims without our own tests. Your speed depends on your connection, the protocol and how far away the server is, so try a nearby server on WireGuard first.

What other testers found

These are other sites' tests, not ours. Each one is credited and linked, and nothing is merged or averaged.

Streaming · In the US

• Safelyo (Netflix; article updated Oct 2026; run from Vietnam): Netflix US played in 4K with no buffering on WireGuard
• All About Cookies (Netflix; tested Oct 2026; run from the US): The US Netflix library worked
• Safelyo (Hulu; article updated Oct 2026; run from Vietnam): Hulu US opened on the first attempt
• Safelyo (Prime Video; article updated Oct 2026; run from Vietnam): Prime Video US worked on the first attempt
• Safelyo (Disney+; article updated Oct 2026; run from Vietnam): Disney+ US loaded on the first try
• Safelyo (Max; article updated Oct 2026; run from Vietnam): Max US connected the first time with no proxy errors

Streaming · In the UK

• Safelyo (Netflix; article updated Oct 2026; run from Vietnam): Netflix UK played in 4K with no buffering on WireGuard
• All About Cookies (Netflix; tested Oct 2026; run from the US): The UK Netflix library worked
• Safelyo (BBC iPlayer; article updated Oct 2026; run from Vietnam): BBC iPlayer was unlocked on the first attempt
• Safelyo (ITVX; article updated Oct 2026; run from Vietnam): ITVX was unlocked on the first attempt
• Safelyo (Channel 4; article updated Oct 2026; run from Vietnam): Channel 4 was unlocked on the first attempt

Streaming · In Canada

• All About Cookies (Netflix; tested Oct 2026; run from the US): The Canadian Netflix library worked

Streaming · In Australia

• All About Cookies (Netflix; tested Oct 2026; run from the US): The Australian Netflix library worked

Streaming · country not stated by the source

• Safelyo (Netflix; article updated Oct 2026; run from Vietnam): 28 of the 40 Netflix libraries they tested worked; the 12 blocked ones include Colombia, the UAE, Ireland and Ukraine

Speed

• Safelyo (article updated Oct 2026; run from Vietnam): On WireGuard, an average of 420.47 Mbps download across 5 server locations, keeping 47.2% of an 890.15 Mbps no-VPN baseline measured from Vietnam; the US Seattle server gave 372.46 Mbps, or 41.8%, and the Australian server came last at 356.24 Mbps, or 40.0%
• All About Cookies (tested Oct 2026; run from the US): From a baseline download speed of about 316 Mbps on Windows 11 in the US, download speed dropped by 4.43% on a US server (Dallas), 8.12% on a Canadian server, and 17.62% each on UK and Australian servers; upload speed dropped more, by 24% to 84%. The protocol is not stated

Torrenting

• Safelyo (article updated Oct 2026; run from Vietnam): A 1.08 GB Ubuntu torrent took 2 minutes 12 seconds, against 1 minute 38 seconds without the VPN; in their torrent IP check peers saw only the VPN address, and the kill switch stopped torrent traffic when the VPN dropped. Port forwarding and a SOCKS5 proxy are not offered

Leaks and kill switch

• Safelyo (article updated Oct 2026; run from Vietnam): No DNS, IPv6 or WebRTC leaks on servers in several regions, checked on ipleak.net and dnsleaktest.com; the kill switch cut traffic at once when the VPN connection dropped
• All About Cookies (tested Oct 2026; run from the US): No leaks in the BrowserLeaks DNS and WebRTC tests. The kill switch test failed: on a switch from a Canadian server to a Mexican server with the kill switch on, DNS requests reached the internet provider's servers (seen on ipleak.net), in both the soft and the strict mode

Two sites have tested Surfshark, and on one point they do not agree. All About Cookies ran its tests in mid-October 2026, on a Windows computer in the US, and its article does not say which protocol it used. Safelyo’s article, updated in late October 2026, reports tests run from Vietnam on WireGuard. Both report that Netflix US and UK worked, and All About Cookies the same for Canada and Australia. Safelyo reports that Hulu, Disney+, Prime Video and Max played in the US and that the UK services it tried, BBC iPlayer among them, played too, but that some of the Netflix libraries it tried were blocked. The two measured speed from different places, so their figures cannot be compared directly: All About Cookies reports small download losses on nearby servers and larger upload losses, and Safelyo, measuring from Vietnam, reports a much larger drop. The kill switch is where they differ. All About Cookies reports that it failed its test: when it switched from one server to another with the kill switch on, DNS requests reached its internet provider, in both kill switch modes. Safelyo reports that the kill switch cut traffic at once when the connection dropped. Those are two different tests, a server switch and a dropped connection, so one does not cancel the other. None of this is our own result, and none of it feeds into our verdict. Our own kill switch test is on the list above.

Surfshark alternatives

Surfshark alternatives compared

#	VPN	Best for	Jurisdiction	Simultaneous devices	Money-back guarantee
1	NordVPN	Best for a long audit record	Panama	10	30 days
2	Proton VPN	Best if you want a free plan	Switzerland	10 (VPN Plus)	30 days
3	PureVPN	Best for a paid trial week	British Virgin Islands	10	31 days

• NordVPN – choose it if you want a longer run of no-logs audits and are happy with a device limit. Read our NordVPN review.
• Proton VPN – choose it if you want a permanent free plan rather than a trial week. The free plan has limits on devices and locations; the paid plan is run from Switzerland.
• PureVPN – choose it if you want split tunneling on a Fire TV Stick. Its privacy record is mixed, so read our PureVPN review first.

How we checked these facts

Every figure on this page comes from Surfshark’s own website, its help center or its public audit reports. Our editors check each price themselves as a US buyer would see it, and re-check prices every two weeks and other figures at least every four months. Where Surfshark does not publish a figure, we leave it out rather than estimate it. We have not run our own speed or streaming tests; the test results we quote are another site’s and are credited to it. The verdict, pros and cons are our editorial judgment based on these facts.

FAQ

Is Surfshark safe to use?

Surfshark has a kill switch in most of its apps, says its servers run from RAM, and has had its no-logs policy examined by Deloitte and its systems tested by SecuRing and Cure53. Against that, an outsider reached an internal test server in 2026, and only Surfshark itself has investigated so far. The Fire TV app for Vega OS also has no kill switch.

Does Surfshark keep logs?

Surfshark says it does not log your IP address, browsing history, traffic or connection timestamps. Deloitte examined that policy in 2023 and again in 2025. Surfshark does keep your email address, encrypted password and billing details, plus the minimal connection data it needs to run the service.

Where is Surfshark based, and who owns it?

Surfshark is run by Surfshark B.V. in Amsterdam, the Netherlands, and was founded by Vytautas Kaziukonis. Surfshark says it and Nord Security merged under one holding company in 2022 and still operate independently.

How many devices can I use with one Surfshark subscription?

One subscription covers an unlimited number of devices at the same time. The free trial is the exception: during the trial you can connect only a few devices.

How much does Surfshark cost after the first term?

The low monthly price applies to the first term only. Surfshark’s pricing page did not show the renewal price when we checked, so the price table above has no renewal figure. Look for the renewal terms at checkout before you pay.

Does Surfshark have a free plan or free trial?

Surfshark has no permanent free plan. It offers a free trial week on its one-year and two-year plans, which needs a payment method and turns into the paid plan automatically unless you cancel first.

Was Surfshark hacked?

In 2026 an outsider reached an internal Surfshark test server that had been left open to the internet by mistake, along with some internal engineering material and build credentials. Surfshark says user data, the VPN service and its apps were not affected and that the credentials have been rotated or disabled. The investigation was Surfshark’s own, and the independent audit it promised has not been published yet.

Does Surfshark work with Netflix?

We have not tested Surfshark with Netflix yet, so we cannot answer from our own results. All About Cookies reported in October 2026 that the US, UK, Canadian and Australian Netflix libraries worked in its tests. Streaming services block VPN addresses from time to time, so use the free trial or the refund period to check for yourself.

Related guides

• NordVPN review
• NordVPN vs Surfshark
• PureVPN review
• Best VPNs for the US
• Best VPNs for the UK