Surfshark review
Surfshark suits developers and small teams who want a Linux GUI, exportable WireGuard configurations and external scrutiny of its privacy claims. Watch the renewal price: the introductory rate is only part of the cost of staying subscribed.
How we make money: links may become affiliate links, but our scoring code never sees commissions, and most providers listed pay us nothing.
Score breakdown
One formula for every commercial vpn, explained on how we score VPNs.
Plans and the true 3-year price
| Plan | Term | Monthly | Renews at | 3-year cost | Devices |
|---|---|---|---|---|---|
| Starter, 24 months + 3 bonus months | 27 months | €2.49 | €5.88 | €120 | unlimited |
| Starter, 12 months + 3 bonus months | 15 months | €3.39 | €5.88 | €174 | unlimited |
| Starter, 1 month | 1 month | €16.45 | €16.45 | €592 | unlimited |
| One, 24 months + 3 bonus months | 27 months | €2.79 | €7.37 | €142 | unlimited |
| One, 12 months + 3 bonus months | 15 months | €3.59 | €7.37 | €209 | unlimited |
| One, 1 month | 1 month | €18.95 | €18.95 | €682 | unlimited |
| One+, 24 months + 3 bonus months | 27 months | €4.49 | €8.85 | €201 | unlimited |
| One+, 12 months + 3 bonus months | 15 months | €7.49 | €8.85 | €298 | unlimited |
| One+, 1 month | 1 month | €21.85 | €21.85 | €787 | unlimited |
Providers change prices often, and we regularly verify prices against their own pricing pages, though small differences from current prices are possible. Prices checked 11 Oct 2026. Refund window: 30 days.
Who it's for
Pick it if
- You want a Linux GUI and WireGuard configuration export.
- You use split tunnelling or multi-hop.
- You value external assurance and can accept customer-only access to the logging reports.
- You can commit to a longer plan after checking its renewal cost.
Skip it if
- You need port forwarding.
- You want to register without an email address.
- You require publicly accessible no-logs assurance reports before buying.
Audit evidence
| Date | Auditor | Type | Scope | Report |
|---|---|---|---|---|
| 30 Mar 2026 | Cure53 | Other | White-box penetration test and source code audit of the in-house Dausos protocol: architecture, control and data channels, crypto design and key exchange, session management and rekeying (testing Feb-Mar 2026, 16 person-days). Only the management summary is published. | Gated or summary only |
| 12 Dec 2025 | SecuRing | Infrastructure | Penetration test of the network infrastructure (test period 2025-12-01 to 2025-12-10); one SSL/TLS configuration finding, reported fixed. Public version of the report. | Public report |
| 9 Jun 2025 | SecuRing | App / client | Black-box and gray-box penetration test (OWASP) of the desktop apps (Windows, macOS, Linux), mobile apps (Android, iOS), browser extensions (Chrome, Firefox, Edge) and web apps, run 2025-02-24 to 2025-04-03. Only a signed attestation letter is public, not the full report. | Gated or summary only |
| Jun 2025 | Deloitte | No-logs assurance | ISAE 3000 assurance on adherence to the no-logs policy: standard, static and multiport VPN servers, server configuration and deployment, privacy settings and procedures. Report is available only inside the customer account. | Gated or summary only |
| Jan 2023 | Deloitte | No-logs assurance | Assurance on the no-logs policy: server and VPN server configuration, deployment process, infrastructure API, software-defined network, staff interviews. Report is available only inside the customer account. | Gated or summary only |
| 20 Apr 2021 | Cure53 | Infrastructure | White-box configuration audit of the VPN server configuration and VPN configuration on five servers (testing second half of March 2021); four findings of limited severity, fixes verified. Only the management summary is published. | Public report |
| 12 Nov 2018 | Cure53 | App / client | Penetration test and code audit of the Chrome and Firefox browser extensions, including IP and DNS leak checks (November 2018); two low or informational findings. Full report, hosted by the auditor and linked from Surfshark's Trust Center. | Public report |
Ownership
Security and features
- WireGuardYes
- RAM-only serversYes
- Full-disk encryptionUnknown
- Post-quantum optionYes
- Open-source appsUnknown
- Kill switchYes
- Split tunnellingYes
- Multi-hopYes
- Port forwardingNo
- IPv6No
- WireGuard config exportYes
- SOCKS5 proxyUnknown
- Custom DNSUnknown
- Linux app (GUI)Yes
- Linux CLIUnknown
- Dedicated IPYes
Network Provider-reported
- Servers4500
- Countries100
Account and payment privacy
- Sign up without emailNo
- Account-number loginUnknown
- CashUnknown
- MoneroUnknown
- BitcoinUnknown
Our take
Surfshark's privacy case rests partly on Deloitte's no-logs assurance engagement dated Jun 2025, covering server types, configuration, deployment, privacy settings and procedures. The report is accessible only through a customer account, limiting what you can inspect before subscribing. SecuRing's infrastructure report dated 12 Dec 2025 is public and records an SSL/TLS configuration finding reported fixed. That supports a narrower conclusion about infrastructure testing, not a logging guarantee. The Dausos protocol audit dated 30 Mar 2026 examined architecture, cryptography and session handling, but only its management summary is published. Read these as evidence about particular systems and review periods, rather than a promise covering everything the service might do.
Surfshark B.V. belongs to the Nord Security group, which also owns NordVPN. If you are choosing separate VPN subscriptions to spread your reliance across owners, that connection matters: switching between these brands does not achieve that separation. Named leadership and a transparency report give you useful accountability signals, although they do not replace technical evidence. Our incident review found none, which means none found, not proof of an incident-free history. Registration also requires an email address, so account privacy deserves attention alongside the tunnel itself.
Judge the subscription by its introductory term and renewal rate together. Starter begins at €2.49 a month for 27 months, then renews at €5.88 a month. Its modeled total in the plans table is €120. The equivalent One and One+ offers renew at €7.37 and €8.85 a month respectively. Start your comparison with Starter, then justify any upgrade by what you will actually use. The 30 days refund window is useful for evaluating suitability, but the longer commitment still deserves a budget check.
For developers, the useful combination is a Linux GUI, WireGuard configuration export and split tunnelling, giving you options for how to connect and which traffic to route. RAM-only servers and a post-quantum option add security features, without settling every privacy question. Against alternatives such as Mullvad, IVPN and Proton VPN, compare the evidence you can inspect, account requirements and ongoing cost rather than feature totals alone. Surfshark has no port forwarding, so a dedicated IP should not be mistaken for a way to expose your own services. If reaching your machines is the main job, start with the private-access comparison.
FAQ
Has Surfshark's no-logs policy been audited?
Deloitte's no-logs assurance engagement dated Jun 2025 examined adherence to the policy across server types, configuration, deployment, privacy settings and procedures. The report is available only through a customer account, so you cannot inspect it publicly before subscribing.
Do Surfshark and NordVPN have the same owner?
Surfshark B.V. belongs to the Nord Security group, which also owns NordVPN. Choosing subscriptions from these brands does not spread your reliance across independent ownership groups.
How much does Surfshark cost when it renews?
The Starter offer with a 27 months introductory term starts at €2.49 a month and renews at €5.88 a month. Check the renewal attached to your chosen plan, since the introductory price does not describe the ongoing cost.
Does Surfshark have a Linux app?
Surfshark has a Linux app with a graphical interface and supports WireGuard configuration export. That gives you a choice between the app and configuring a compatible WireGuard client yourself.
Can I use Surfshark to reach my home server?
Surfshark has no port forwarding, so you cannot use that route to accept inbound connections to your server. Dedicated IP availability does not change this limitation; for access to your own machines, compare approaches in our private-access guide.
Can I sign up for Surfshark without an email address?
No, Surfshark requires an email address to register. If avoiding an email-linked VPN account is a requirement, choose a service whose registration process meets it.