Surfshark VPN Review: Plans, Devices and Privacy Limits

The important choice is the subscription and app that fit your household. This review explains the upfront bill, renewal, trial conditions and privacy limits, then gives practical checks for the devices and services you actually use.

Every paid consumer tier includes the VPN. The shared comparison below summarises its core scope; the plan breakdown later separates VPN functions from antivirus, breach alerts and data-removal products.

A VPN encrypts traffic between the connected app and a VPN server and changes the outward IP address seen by a website. It does not make a logged-in account anonymous, stop every phishing message or protect an app you deliberately exclude. HTTPS still matters beyond the VPN server.

For covered traffic, the VPN tunnel runs from your device to the VPN server. HTTPS separately protects web content to the website. Accounts, cookies and information you submit can still identify you; an excluded app bypasses the VPN tunnel.

Surfshark offers WireGuard, OpenVPN and IKEv2 across supported apps, with availability varying by platform. Its newer Dausos protocol is currently a macOS feature. Do not assume an announcement means that it is available on Windows, Linux or Android. On a supported Mac, the vendor’s documented path is Settings → VPN settings → Protocol → Dausos.

MultiHop routes traffic through two VPN locations and can be useful when you want that extra separation. It may also add delay, so start with a nearby single server for ordinary video calls and downloads. A kill switch is intended to prevent traffic escaping when the tunnel drops; confirm its behaviour on the app and operating system you use.

Bypasser deliberately sends selected traffic outside the VPN. Surfshark’s split-tunnelling guidance distinguishes supported desktop and Android app controls from iOS website exclusions. An iPhone website exception is not a general ability to exclude any app. Keep sensitive work and banking traffic in the route you intended.

CleanWeb is a filtering feature, not proof that every scam, malicious download or advertisement will be blocked. Browser extensions, desktop apps and bundle antivirus have different scopes; compare the specific app’s controls rather than treating them as one universal security layer.

Performance, streaming and downloads: What to check

A useful speed assessment needs the same device, network, time window and destination with the VPN off and on. No single advertised speed or percentage loss establishes what you will get on your connection.

Start with the nearest suitable server and the default or WireGuard protocol. Run several tests before and after connecting, then compare download speed, upload speed and latency separately. A large download can tolerate a delay that would make a voice call uncomfortable. Repeat at the time you normally use the connection.

Test one distant location only if it serves a real need. If performance falls, try another nearby server, another supported protocol and a different network before blaming the subscription tier. Check whether a router, antivirus filter or a second VPN is affecting the result.

For streaming, check the exact lawful service, account region and device you plan to use. A working location today does not guarantee access later: services can block VPN addresses or apply account and licensing restrictions. Streaming availability is a reason to use the evaluation period, rather than a promise attached to the headline price.

For permitted peer-to-peer downloads, confirm that the VPN remains connected, the kill switch behaves as expected and the download client is not accidentally excluded. A changing exit address, network congestion or local storage limit can affect the result. A VPN does not change copyright obligations.

In countries or networks that restrict VPNs, connectivity can vary and attempts may be subject to local rules. No location list or obfuscation label guarantees service. Keep an appropriate alternative connection for essential communications and check current official support before relying on it.

A practical setup and acceptance check

Install from Surfshark’s official download page or the correct platform store. Confirm the publisher and your operating-system version, sign in, then make a normal connection before changing advanced settings.

After connecting, compare the public IP address with the disconnected result. Use a reputable IP/DNS check to look for unexpected network identifiers, and test a normal website over HTTPS. Such checks help find a configuration mistake; they are not a comprehensive security audit.

Enable the kill switch if it fits your workflow. Test disconnect, reconnect, sleep and wake on your own device while using a harmless page or download. Check whether the app blocks traffic, reconnects or needs attention, rather than assuming that another operating system behaves identically.

On public Wi-Fi, finish the genuine venue’s captive-portal sign-in if it is required, then reconnect the VPN and confirm its status. Never install an unfamiliar certificate or profile simply to make a hotspot work. Use mobile data if the network remains suspicious or prevents a reliable connection.

Use Bypasser only for an explained exception, such as a local device or a service that cannot work through the tunnel. Review the exception after a network change. If a banking site fails, first check the bank’s guidance and try an appropriate connection rather than broadly excluding all sensitive apps.

For a fault report, note the app version, operating system, connection type, selected location, protocol and approximate time. Do not send passwords, authentication codes or unredacted account details. The official help centre contains platform setup and troubleshooting guidance.

Unlimited paid devices does not mean identical features

Seven-day website trial

Up to three VPN devices during the trial.

Paid consumer VPN

Unlimited simultaneous VPN connections.

Additional bundle products

Check each product’s supported platforms and residence eligibility.

The paid subscription permits unlimited simultaneous VPN connections. That is useful when a household has phones, computers and a TV, but it does not turn every device into an antivirus endpoint or remove platform restrictions. The website’s free trial permits only three devices until the trial ends.

Surfshark lists apps for Windows, macOS, Linux, Android, iOS and supported television platforms. Check the current supported version before buying for an older device. Router configuration depends on compatible firmware and protocols; a router connection is a network deployment, not proof that every VPN-app control appears on the router.

A browser extension covers its supported browser traffic. It is not a substitute for a device-wide VPN when another app, game or download client needs protection. Conversely, the full VPN can affect local printers, casting and work access, so test those alongside browsing.

On iOS, Bypasser’s website exclusions differ from desktop or Android app controls. Dausos is currently limited to supported macOS use. Antivirus and other One-bundle products have their own platform requirements, which should be checked independently of the VPN app.

For a family purchase, list the devices that need VPN coverage and then the devices that actually need the extra security products. Paying for One+ solely because it sounds more complete can be poor value when its principal additional service is unavailable where you live.

Starter, One and One+: Compare the total bill

Starter is the VPN-first choice. One adds products such as antivirus, breach monitoring and private search; One+ adds Incogni data-removal coverage. These are separate services, with their own coverage and compatibility. Use the current plan comparison to confirm exactly what your order includes.

On 6 October 2026 (UTC), the pricing page served a euro-denominated introductory example covering 27 months: Starter €67.23 (€2.49 per month equivalent), One €75.33 (€2.79), and One+ €121.23 (€4.49). These are upfront introductory totals, not monthly instalments or universal dollar prices. VAT, location, checkout currency and offers can change the final amount.

For that specific example, One costs €8.10 more than Starter across the first 27 months. One+ costs €54 more than Starter. Choose the upgrade only if the added products fill a need and support your devices; a small equivalent monthly figure can conceal the total commitment.

Incogni is advertised for residents of the US, UK, EU, Switzerland and Canada. The listed identity-theft coverage is limited to eligible US residents and excludes New York State. A customer elsewhere should not assign those advertised benefits the same value without confirming eligibility.

The two-year introductory purchase is billed upfront and then renews annually. Surfshark’s renewal and currency policy says renewal uses the standard non-introductory rate and applicable taxes; separately purchased add-ons have their own renewal terms. Check the actual order or account amount and renewal date before committing.

The billing policy also distinguishes the displayed currency from the charge currency determined by the payment method and region. Compare the checkout total in the currency you will actually pay, including any bank conversion fees. Save the receipt and a reminder before renewal.

Surfshark’s seven-day website trial applies to eligible 12- or 24-month selections with supported payment methods, including PayPal, Apple Pay and cards. It is limited to three devices during the trial and can convert to a paid subscription unless cancelled under its terms. Store-based trials have their own offer and billing rules.

The 30-day refund terms concern the initial qualifying purchase, rather than an ongoing free plan or a blanket refund for renewals. Apple/Amazon and other reseller procedures can differ; Surfshark identifies specific supported resellers in its terms. Prepaid and gift-card payments, some add-ons and an activated anonymous Dedicated IP have additional exclusions. Cancelling auto-renewal and requesting a refund are separate actions.

Privacy policy, audits and the data Surfshark still needs

Browsing activity

The stated no-logs policy concerns browsing-activity information.

Temporary connection data

The policy describes deletion within 15 minutes after a VPN session ends.

Account information

Certain account data is retained during activity and for two years after the last login.

Surfshark’s privacy policy, updated 27 August 2026, says it does not retain browsing-history activity of the kind covered by its no-logs policy. That does not mean it has no personal data: account and payment administration still require information.

The policy describes account identifiers and billing information, and says certain account data is retained while the account is active and for two years after the last login. It also describes temporary VPN user identifiers, IP addresses and connection timestamps held for session operation and deleted within 15 minutes after the session ends. Read those categories separately from browsing-activity logging.

Surfshark B.V. is based in the Netherlands. Jurisdiction can matter to a threat model, but a country label alone does not prove what data exists or how a future legal demand would be handled. Examine the actual retention policy, product settings and assurance scope together.

The vendor’s security information reports Deloitte no-logs assurance work in 2023 and 2025, and SecuRing work on apps and infrastructure in 2025. These are dated assessments of stated systems and scope. This review relies on the public summaries and does not claim to have independently inspected the logged-in full reports.

RAM-only VPN-server operation limits what remains stored on a server after shutdown. It does not erase account, billing or website-cookie data held elsewhere, and does not prevent a destination website identifying a signed-in user.

A dedicated IP can reduce some access friction, but a stable address can also make activity easier to link over time. Surfshark’s terms explain how a normal dedicated IP can be tied to account information and how the anonymous option affects refunds. Do not buy it automatically for privacy.

Use the VPN as one part of a broader setup: keep systems updated, use unique passwords and multifactor authentication, and review permissions and browser tracking. If you log into an account or submit your name, the service can identify you despite the VPN.

Support and user feedback: Evidence to use carefully

Surfshark provides an official help centre and support channels. This review does not claim a measured chat wait time, a new support-session test or a current aggregate user-rating sample. Those figures need dated observations and a clear sample.

For a purchase decision, look for recurring reports that match your exact app version, device and task. A streaming complaint on one TV platform may not explain a Windows connection fault. A very old review can describe a feature or price that has since changed.

Use recent user reports to identify what to test, then check official documentation and your own evaluation period. For a billing problem, keep the invoice, order channel, subscription term and cancellation confirmation; for connectivity, record a repeatable sequence and avoid exposing sensitive logs.

If support cannot resolve an essential need in the trial or qualifying refund window, use the correct cancellation/refund process promptly. Do not let an unanswered ticket silently carry you past a billing deadline.

Where Surfshark is a weaker fit

It has no permanent free VPN plan. If you only need occasional basic coverage, the ongoing free tier discussed in our privacy VPN guide may suit you better than an automatically renewing long subscription.

The upgrade bundles are less attractive if your operating system lacks the extra product you wanted or your residence falls outside its coverage. Compare eligible features, not the total number of icons on the plan grid.

It is also a weaker fit when you need a guarantee that one streaming service or a restricted network will work indefinitely. Those outcomes can change independently of the VPN provider. A long introductory term should not replace a successful practical check.

An excluded app or website deliberately bypasses the tunnel. A browser-only extension leaves other apps outside its scope. Corporate VPNs, local devices and third-party network filters can also complicate setup; avoid changing employer-managed settings without the appropriate guidance.

If avoiding account-identifying information is your central requirement, compare the signup and payment approaches of other providers as well as their VPN controls. Unlimited device connections and a low promotional equivalent do not settle that privacy question.

How the ratings reflect this review

The six ratings assess consumer privacy, device coverage and the buying decision. Each is an editorial judgment out of five: 3 means mixed, 4 strong with meaningful limitations, and 5 an exceptional fit for that criterion. Half steps sit between those judgments. The overall 4.3/5 is their equal-weight average, rounded to one decimal. These category-specific criteria replace the earlier general software scorecard.

• Privacy assurance — 4.5/5: Published no-logs assurance supports the privacy assessment; account, operational and optional-product data still need separate consideration.
• Connection controls — 4.5/5: Kill switch, supported protocols and MultiHop offer useful controls; a tunnel does not provide complete device security.
• Platform feature coverage — 4.0/5: Broad app coverage with useful routing options; iOS website exclusions and macOS-only Dausos are material differences.
• Household device allowance — 5.0/5: Unlimited simultaneous paid VPN connections are a particularly strong fit for a large household; the trial has a smaller allowance.
• Plan and renewal terms — 3.5/5: Starter, One and One+ require a separate check of upfront cost, annual renewal and the added products you will use.
• Setup and help resources — 4.5/5: The help centre provides platform setup and fault-report guidance; this score concerns available resources, not measured support success.

Final verdict: Choose the smallest bundle that fits

Choose Starter if you mainly want VPN coverage across many personal devices and your trial confirms reliable access. Choose One if its additional security products support the devices you use and replace a real need. Choose One+ when you are eligible for Incogni and want that separate data-removal service, rather than simply assuming that the highest tier is best.

Check the initial total, actual renewal amount, charge currency and trial/refund conditions before paying. The three-device trial limit and unlimited paid-device allowance are different. Evaluate your local-device access, calls and required services before taking a long term.

For alternatives, our NordVPN review explains its ten-device allowance and platform-specific protection, while Surfshark vs ExpressVPN compares unlimited paid connections with ExpressVPN’s plan-dependent device limits.

Frequently Asked Questions

Share this article

WhatsAppLinkedInRedditFacebookX