Surfshark Review (Oct 2026): Verified Prices, Audits, Gaps

Surfshark is worth buying on its 27-month introductory plan if you want one subscription for an unlimited number of devices. It also suits you if you want an audited no-logs policy and a RAM-only network. In return, you have to live without port forwarding and without SmartDNS, which Surfshark retired in February 2026.

We checked prices on 31 October 2026, during a Black Friday promotion. The Starter and One tiers both cost $2.49 a month, or $67.23 for the first 27 months. That is lower than NordVPN’s $3.49 and ExpressVPN’s $2.99 on their equivalent long plans.

The weak points are just as concrete:

• The pricing page does not state what the plan renews at.
• The month-to-month price of $18.95 is the highest entry-level monthly price among the providers we track.
• Your privacy depends on a Dutch company inside the 9 Eyes alliance.

This review sets out every number with its date and source. Our score for Surfshark is shown above.

Privacy and logging

Surfshark is run by Surfshark B.V., which is registered in Amsterdam with KvK number 81967985. Since 2022 it has shared a holding company with Nord Security, NordVPN’s parent. The two brands still operate separately. The Netherlands belongs to the 9 Eyes, a group of countries that share intelligence. That is the one structural privacy disadvantage Surfshark has against its main rivals. NordVPN is based in Panama, ExpressVPN in the British Virgin Islands and Proton VPN in Switzerland. In practice, what matters is what Surfshark chooses to keep and what it has been made to hand over. The record on both is below.

The privacy policy was last updated on 12 October 2026. It says Surfshark does not collect:

• the IP addresses you visit
• your browsing history
• session information
• connection timestamps
• used bandwidth
• network traffic

It does keep some data:

• account data: your email address, encrypted password and registration date
• billing data: a partial card number, the expiry date and the payer’s country
• aggregated performance and diagnostic data

Connection details are held on the VPN server for a short time. They are deleted within 15 minutes after the session ends. Most competitors do not spell out this detail.

Deloitte has checked the no-logs claim twice. These checks are assurance engagements, in which an auditor tests whether a company does what its policy says. The first report was announced on 25 January 2023. It covered server and VPN configuration, the deployment process, APIs and the software-defined network. The second was announced on 16 June 2025. It was an ISAE 3000 engagement that covered standard, static and multiport servers, plus the configuration and deployment processes. As with NordVPN, only logged-in customers can read the full reports in the account area. So you cannot read the evidence before you pay.

Other firms have tested Surfshark’s security too. A penetration test is a controlled attempt to break into a system.

• SecuRing ran an external penetration test of the network infrastructure in December 2025. Surfshark announced it on 23 January 2026, with no critical vulnerabilities found.
• SecuRing also tested the Windows, macOS, Linux, Android and iOS apps, the browser extensions and the web apps between 24 February and 3 April 2025. It was a black- and gray-box test, which means the testers started with no inside knowledge or only some.
• Cure53 audited the server infrastructure in March 2021.
• Cure53 audited the Chrome and Firefox extensions in November 2018 and found two low-impact issues.
• In February and March 2026, Cure53 audited the new Dausos protocol. It reported no critical or high findings within the protocol itself.

Our data record shows no incidents for Surfshark as of 31 October 2026. There are no documented server seizures or breaches, and no warrants that led to disclosure. The transparency report for July to September 2026 lists:

• 23 government inquiries
• 0 warrants
• 0 National Security Letters
• 0 gag orders
• 309,186 DMCA notices, which are copyright complaints under US law

It states that none of the requests led to the disclosure of data related to users’ online activity. Surfshark says it is moving away from its warrant canary in favor of these quarterly reports. A warrant canary is a public statement that a company has not received secret government orders. So there is no canary left to check.

If you want to limit what Surfshark knows about you, you can pay with cryptocurrency at a desktop checkout. This option is not available on phones or tablets. Refunds on crypto purchases are paid back in the same cryptocurrency. Starter also includes Surfshark’s Alternative ID feature.

Security features

A protocol is the set of rules a VPN uses to build its encrypted connection. Surfshark offers four:

• WireGuard, which uses ChaCha20 encryption
• OpenVPN, which uses AES-256-GCM
• IKEv2, which also uses AES-256-GCM
• Dausos, Surfshark’s own protocol, built on the AEGIS-256X2 cipher

Post-quantum protection is on by default for WireGuard and Dausos. It is designed to resist attacks from future quantum computers. Dausos is Surfshark’s main launch of 2026. But on 31 October 2026, it was available only in the macOS App Store app. Surfshark says other platforms will follow, without naming them or giving a date. For Dausos, Surfshark claims a dedicated tunnel per user and speeds up to 30% faster than industry-standard protocols. We have not tested this, so we record it as a claim. The Cure53 management summary, dated 30 March 2026, is public. The no-logs reports, by contrast, are not.

A kill switch blocks your internet if the VPN connection drops. Surfshark’s kill switch works on Windows, macOS, Linux, Android and iOS, with soft and strict modes.

Split tunneling lets you choose which apps or sites use the VPN. Surfshark calls its version Bypasser, and it runs on Windows, macOS, Android and iOS. On Windows, its Bypass VPN mode takes apps, websites and IP addresses. Only the Route via VPN mode is limited to apps. Android adds a Reverse Bypasser mode. NordVPN’s split tunneling skips macOS and iOS entirely, so Surfshark covers more devices. This is one of the main reasons Apple users pick Surfshark.

Surfshark also has these extras:

• obfuscated servers, which disguise VPN traffic
• NoBorders mode, for restrictive networks
• Dynamic MultiHop, which sends your traffic through two servers in a row
• Rotating IP, which the plans post says is on macOS only
• Everlink
• CleanWeb, which blocks ads and trackers
• a dedicated IP add-on in 20 locations

Surfshark says it runs private DNS on every server, and the apps include DNS leak protection. The network is 100% RAM-only. A RAM-only server keeps nothing on a hard drive, so a restart wipes it. Surfshark has 4,500+ servers in 100 countries, across 130+ locations, on 10 Gbps ports. Some locations are virtual, which means the server is physically somewhere else. The Indian locations, for instance, are hosted in Singapore, the Netherlands and London. Surfshark does not state who owns its servers.

Surfshark has two gaps. The first is port forwarding, which opens a port so other devices can connect to yours. Surfshark does not support it. It explained why in a blog post dated 9 September 2026: an open port “creates a potential network entry point”, so it chose not to offer one. That rules Surfshark out if you seed torrents and need an inbound port.

The second gap is IPv6, the newer format of internet address. The security features page says IPv6 and WebRTC leaks are blocked. But the help center says Surfshark does not support IPv6, and it recommends turning IPv6 off on your device. Both statements can be true, because blocking IPv6 is not the same as sending it through the VPN. They are still confusing. A dual-stack connection uses both the old and the new address formats. If you have one, run our IPv6 leak test before you rely on Surfshark. After installing, check the connection with our VPN check tool.

Apps and usability

Surfshark has its own apps for:

• Windows, macOS and Linux
• Android and iOS
• Android TV and Google TV
• Fire TV, including the newer Vega OS devices
• Apple TV with tvOS 17 or later

There are also extensions for Chrome, Firefox and Edge. Samsung Tizen and LG webOS TVs have no app, and Surfshark points those users to a router setup. Routers work through manual setup. The help center has guides for GL.iNet, Asus, OPNsense and FRITZ!Box, among others. Unlimited devices at the same time is Surfshark’s biggest practical advantage. NordVPN allows 10, ExpressVPN allows 10 on its Basic tier and CyberGhost allows 7.

SmartDNS, which you may have read about elsewhere, no longer exists. It let you use streaming services on devices that cannot run a VPN app. Surfshark has not supported it since 2 February 2026. Its help center notice says demand was very limited. It also says the feature took resources that Surfshark would rather spend on speed, security and VPN features. Instead, it recommends:

• a VPN-protected hotspot from a Windows PC
• a router setup
• Surfshark’s own Android TV and Apple TV apps

This matters if you bought Surfshark for a Samsung or LG TV. Surfshark warns that anyone who still has SmartDNS set up must remove the DNS settings by hand. Otherwise the TV may lose its connection.

Surfshark’s official streaming page lists Netflix, Prime Video, Disney+, BBC iPlayer, HBO Max, Hulu and Crunchyroll. It adds that results may vary and platform terms apply. We have not yet tested streaming access. So the table above records these as Surfshark’s documented claims. Our Surfshark and Netflix guide will carry test results once our lab is running. We have not yet tested speed in our lab either.

Open-source apps publish their code for anyone to read. No Surfshark app is open source, and no official page says otherwise. The SecuRing and Cure53 app audits are the evidence that makes up for this. The Android app has a MASA certification, listed in the Trust Center. We have not yet published our own usability tests or screenshots. The feature table above shows what Surfshark documents as of 31 October 2026. If the app will not connect, our Surfshark not connecting guide covers the common causes.

Support

Live chat runs 24/7, and email support is available. The help center is large and up to date. It was the source for the SmartDNS and refund facts on this page. We have not yet measured response times. So the support score reflects what is available, not how good it is. Support also cannot send the Deloitte reports to people who are still deciding, because the reports sit behind the login.

Plans and the renewal price

Surfshark sells three tiers:

• Starter is the VPN plus Alternative ID.
• One adds Surfshark Antivirus, Surfshark Alert and scam protection.
• One+ adds Incogni, a data-removal service.

On 31 October 2026, the pricing page showed only the 24-month plans. Each came with three extra months as a Black Friday deal. Starter and One both cost $2.49 a month, billed $67.23 for the first 27 months. One+ cost $3.99 a month, billed $107.73. So if you want the antivirus, One costs the same as Starter during this promotion. CyberGhost at $2.19 and Private Internet Access at $2.03 go lower, on even longer terms. But neither combines unlimited devices with Surfshark’s feature set.

The 1-year and monthly prices are filled in by scripts on the pricing page. We read them from the plan data the page itself loads, which matches every price the page prints. On 5 November 2026, Starter cost $2.99 a month on the 1-year plan. That plan also comes with 3 extra months, so you pay $44.85 for 15 months. Month to month, Starter costs $18.95. One and One+ cost more month to month, and the pricing page lists them. Until 5 November we used Surfshark’s blog post “Surfshark VPN plans explained” for these figures, with prices dated 30 July 2026.

The same post listed the 24-month One and One+ plans at $2.79 and $4.49 a month. That shows how far the Black Friday promotion has cut those two tiers. Our Surfshark pricing page keeps the price history. The Surfshark deals page tracks whatever promotion is running when you read this. Our Black Friday VPN deals page compares it with the other brands’ offers.

We could not find the renewal price. The pricing page says only that “upon renewal, you will be charged the applicable renewal price”. The FAQ says the 2-year plan is billed once and then every year. No page we could read states the renewal amount, so our data record lists it as unknown. Every other major brand we track publishes a figure. NordVPN renews its 27-month Basic plan at $139.08 a year, and ExpressVPN renews its 28-month Basic plan at $99.95. Until Surfshark publishes one, treat the renewal as an unknown yearly charge. If you want control, turn off auto-renewal after you buy. Read our Surfshark cancellation guide before the term ends.

The 30-day money-back guarantee applies to your first purchase only, and only once per service. These are excluded:

• subscriptions that have already renewed
• prepaid and gift-card payments
• Alternative ID
• the anonymous dedicated IP

The App Store and Amazon refund purchases made through them, under their own rules. You ask for a refund through live chat, and it usually arrives within a few business days. There is no free tier. New users can get a 7-day free trial on the 12- and 24-month plans, limited to 3 devices during the trial. The trial needs a card, PayPal or Apple Pay, and it becomes a paid plan unless you cancel. Our VPN free trial page compares it with other trials and free plans. VAT may be added at checkout, depending on your country.

Who it is for and who should skip it

Surfshark fits:

• households and small teams that want every phone, laptop and TV on one plan
• people who need split tunneling on a Mac or iPhone
• travelers who need obfuscation or NoBorders mode on restrictive networks
• anyone who wants an audited long plan priced below NordVPN, ExpressVPN and Proton VPN, as of 31 October 2026

It is also a sensible choice if you want the antivirus and the other One extras at the Starter price during this promotion.

Skip it if:

• you seed torrents and need port forwarding
• you relied on SmartDNS for a Samsung, LG or Roku device
• you are buying month to month, because $18.95 is the highest entry-level monthly price among the providers we track
• you want to know the renewal price before you commit

Some privacy purists object to a 9 Eyes jurisdiction, an owner shared with NordVPN, closed-source apps and audit reports behind a login. They should look at Proton VPN, Mullvad or IVPN instead. If you want IPv6 traffic sent through the VPN rather than blocked, Proton VPN is the only big brand in our table that routes it.

Alternatives

NordVPN shares Surfshark’s owner. It costs $3.49 a month on its 27-month Basic plan, or $94.23, and renews at $139.08 a year. It has had six no-logs checks to Surfshark’s two, and it still offers SmartDNS. But it limits you to 10 devices and has no split tunneling on macOS or iOS. Our NordVPN vs Surfshark comparison goes line by line.

ExpressVPN costs $2.99 a month on its only published plan, which runs for 28 months. That is $83.72, and it renews at $99.95 a year. ExpressVPN states its renewal price, publishes three KPMG no-logs audits and offers split tunneling on every platform. But it has no multi-hop and four incidents on record. See ExpressVPN vs Surfshark.

Proton VPN is the privacy-first alternative. It is Swiss, with open-source apps, yearly Securitum audits, port forwarding and a free tier. It costs $3.49 a month on its 2-year Plus plan. That is $83.76, and it renews at $83.88 a year. See Proton VPN vs Surfshark.

CyberGhost is cheaper still, at $2.19 a month for 26 months. That is $56.94, and it renews at the same amount for 12 months. It has a 45-day refund. But it allows 7 devices and has no obfuscation or multi-hop. See CyberGhost vs Surfshark.

Private Internet Access offers port forwarding, open-source apps and unlimited devices. It costs $2.03 a month on a 40-month plan. That is $81.20, and it renews at $81.20 every three years. It operates under US law. See Private Internet Access vs Surfshark.

Our rankings by use place Surfshark next to all of these. See our best VPN for streaming, best VPN for Netflix and best VPN for torrenting pages, or the full provider list.

How we verified this review

We read every price, plan term, refund rule, server count and feature on this page from Surfshark’s official pages on 31 October 2026. The HTML of the pricing page showed only the 24-month plans. So the 12-month and monthly prices come from Surfshark’s blog post of 22 September 2026, and we date them to that post. We record the renewal price as not stated, because no official page we could read states it. Our other sources:

• audit dates: Surfshark’s own announcements and the auditors’ published summaries
• SmartDNS and port-forwarding facts: Surfshark’s help center and blog
• transparency figures: the report covering July to September 2026

We have not yet run speed or streaming tests. That is why speed is left out of the score and streaming entries are labeled as claims. The data record behind this page is public. Our how we test page describes the lab that will replace the claims with measurements.