Surfshark VPN Review 2022: An Affordable VPN With Plans for Cutting-Edge Privacy

Surfshark

$2.49/mo + 2 months free at Surfshark

Like

• Best value VPN in 2022
• Lots of unique security features
• Unlimited simultaneous connections
• RAM-only server network

Don't like

• Inconsistent speed performance
• 14 Eyes jurisdiction (Netherlands)
• No transparency reports
• Trouble unblocking Disney Plus in tests

Surfshark has earned a spot as CNET's Editors' Choice for Best Value VPN in 2022. Surfshark offers tremendous value with an impressive suite of privacy and security features, easy-to-use user interface, unlimited simultaneous connections and one of the largest server networks in the industry -- all at a price that's cheaper than most competitors. 

Founded in 2018, Surfshark is a relative newcomer to the VPN space, but is proving itself to be one of the best VPNs available. It's a forward-looking VPN provider that's really putting the heat on the competition with some innovative ideas on what a VPN can accomplish. We recommend Surfshark as a first-rate option for both novice and advanced VPN users. 

That said, we'd like to see a greater degree of transparency from Surfshark as well as more consistent speed performance across its server network. The company's Netherlands jurisdiction is also somewhat of a concern due to the country's data-sharing agreements with the United States and other nations. Otherwise, Surfshark is a solid VPN that does a lot to go above and beyond while keeping its prices competitive.

Speed: Fast, but occasional speed dips were a disappointment

• 19% speed loss in autumn 2022 tests
  
• Number of servers: 3,200-plus
  
• Number of countries: 99
  

Although it's still one of the fastest VPNs we've tested, Surfshark's speeds in our Sept. 2022 tests were somewhat disappointing. Overall, we saw a 19% speed loss during our testing, with average speeds while connected to the VPN clocking in at 297.27Mbps compared to our regular average internet speeds of 367.22Mbps. That's slightly slower than the 17% speed loss we calculated two years prior. However, Surfshark's inconsistent speed results were even more disappointing than the minimal dip in speeds. 

We tested Sufrshark's speeds from Ohio to VPN servers located in New York City, London, Sydney, Paris, Frankfurt and Singapore. Typically, VPN speeds should be the fastest when you're connecting to a server that is closest in proximity to your physical location. That's why we were surprised to see that the speeds we measured to the UK were faster at 343.83Mbps than the 302.61Mbps we measured to New York. More surprising, speeds to Australia were also faster than speeds to New York at 330.98Mbps. Granted, New York is a popular VPN server location for users, so there could have been some server load issues that played a part in those readings, but we still expected speeds to be much faster there.

Speeds to Europe were fairly erratic at times, peaking at 358.86Mbps and dipping all the way to 18.72Mbps, along with a couple of readings around and slightly below 100Mbps. All of this contributed to a relatively meager average speed of 308.12Mbps to European servers. As expected, speeds to Singapore were the slowest, averaging out at 200.80Mbps. However, connections to Singapore saw the most erratic fluctuations in speeds. Speeds to Singapore topped out at 333.04Mbps, but dropped to as little as 9Mbps, with readings everywhere in between. 

It was surprising to see such extreme fluctuations in speeds from a top-tier VPN provider like Surfshark that has a reputation for offering super-fast connections. Other VPNs like ExpressVPN and NordVPN offer remarkably consistent speeds across their entire network of servers. 

That said, Surfshark is in the midst of dramatically expanding its network, as it now offers more than 3,200 servers in 99 countries -- up from just 65 earlier this year. Perhaps as it adds additional servers, Surfshark will help normalize speeds across its entire network. But for now, it may be difficult to have confidence in the speed of your connection when you connect to a Surfshark VPN server. 

Read more: How to Speed Up Your VPN Connection

Cost: The cheapest top-tier VPN

• $48 for the first year (then $60 annually) or $13 per month. Two-year plans are $60 for the first two years combined (then $60 annually)
  
• Money-back guarantee: 30 days
  
• Payment options: Credit card, PayPal, Google Pay, Amazon Pay, cryptocurrency
  
• Apps available for MacOS, Windows, Linux, iOS, Android, Fire TV
  

Surfshark offers subscription packages that are considerably easier on the pocketbook than what its sister company NordVPN and competitors like ExpressVPN offer. But like many other VPN providers, Surfshark's pricing plans feature low introductory prices for its long-term plans, which get more expensive after the first term of the subscription.

If you go with Surfshark's two-year subscription plan, you'll pay $60 total for the initial two-year term. After that initial term, the plan renews at a rate of $60 per year. The one-year plan costs $48 for the first year, then $60 annually for each additional year of service. By comparison, Surfshark sister company NordVPN charges $60 for its one-year plan right away. The one-year cost of our Editors' Choice, ExpressVPN, is considerably more expensive than both at $100 annually (currently offering three months of extra service for free with the purchase).

If you'd rather go for a short-term plan, you can sign up for the monthly plan at $13 per month. However, ExpressVPN also costs $13 per month. NordVPN's per-month cost is slightly cheaper at $12. For an additional $18 per year -- or $1.50 per month with the monthly plan -- you can bundle Surfshark's data breach alert, antivirus and private search features on top of the base VPN service.

Surfshark accepts all major credit cards, PayPal, Google Pay, Amazon Pay and cryptocurrency, and apps are available for MacOS, Windows, Linux, iOS, Android and FireTV. You can also download the Surfshark browser extension for Chrome, Firefox and Edge browsers. Surfshark offers tutorials on how to set up the service on an array of VPN-capable routers if you'd like to protect your entire network with a single connection, or use it with your smart TV and gaming consoles.

But you won't need a router to connect all of your devices to the VPN at once, since Surfshark offers unlimited simultaneous connections -- you can connect each of your devices individually without any limit. Most VPNs offer anywhere from five to 10 simultaneous connections, but Surfshark is perfect for families or anyone who owns a lot of devices.

Like most top-tier VPN providers nowadays, Surfshark offers 24/7 live chat customer support, which is helpful in case you need a quick resolution to an issue or need help with setting up the VPN on your devices. Surfshark's customer support also includes email and a thorough website section with tutorials and troubleshooting instructions. There's also a helpful blog with all kinds of articles pertaining to what Surfshark is up to, as well as VPNs and privacy matters in general. 

When we tested Surfshark's unblocking capabilities, we had no issues accessing Netflix and Amazon Prime Video. However, we had trouble accessing Disney Plus when connected to Surfshark's servers. The Disney Plus website wouldn't load for most of the servers we tried in the US and in countries where Disney Plus is available. We were able to stream Disney Plus from a server in Boston, so you may need to try a few different servers before you're able to access Disney content. 

If you want to give Surfshark a spin to see how it works for you, you can get a seven-day free trial if you sign up through the Google Play Store or the Apple App Store using an Android, iOS or MacOS device. Once you've signed up for the free trial, you can use the service on any platform. Alternatively, you can purchase a subscription and use Surfshark's 30-day money-back guarantee if you decide within 30 days of purchase that the service isn't for you. 

Security and privacy: Tons of features to keep you safe online

• Jurisdiction: Netherlands
  
• Encryption: AES-256-GCM
  
• RAM-only server infrastructure
  
• Protocols available: OpenVPN, WireGuard, IKEv2/IPsec
  

In April 2022, Surfshark was called out by researchers from AppEsteem for installing a root certificate on users' machines when they downloaded the app -- even if the user terminated the installation. This is a risky practice because it could potentially compromise the security of the data on the device onto which the root certificate was downloaded. 

Surfshark said root certificate installation is necessary for its IKEv2 protocol to work.

"When using the Surfshark root certificate, customers put their trust only in a VPN provider and not a third-party agency that can be compromised," Surfshark told CNET in an email in April. 

"We've been working on turning off the no longer popular IKEv2 protocol and focusing all our efforts on supporting Wireguard and OpenVPN protocols. This will eliminate the need to install the certificate." 

Following AppEsteeem's callout, however, Surfshark ended support for the IKEv2 protocol on Windows in July. The protocol is still supported on MacOS, Android and iOS.

The VPN encrypts connections using the AES-256-GCM algorithm on OpenVPN, WireGuard and IKEv2 protocols, which is virtually uncrackable. Surfshark says its entire network of servers is built on a RAM-only diskless infrastructure, which makes it difficult to collect any user data since it is theoretically never stored on a hard disk.

Though Surfshark merged with NordVPN in February, we didn't find anything in Surfshark's privacy policy or terms of service that would indicate that the company is compelled in any way to share customer information with its parent or sibling companies, including NordVPN. At the time of the merger, Surfshark told us that the company is "legally bound not to share any information between the entities that would go against [its] Terms of Service or Privacy Policy." 

Surfshark says that it has a no-logs policy against collecting any information related to your online activity while connected to its servers. This means the company should have no user data to hand over if authorities were to demand it. Collecting zero logs is standard practice for any reputable VPN service, but a VPN's no-logs claims are impossible to verify with absolute certainty. One of the ways a VPN can bolster such a claim is to undergo an independent third-party audit. 

German cybersecurity firm Cure 53 completed an independent security audit of the VPN in 2021, which concluded at the time that "the Surfshark maintainers have a clear understanding of security and privacy challenges associated with being a VPN provider."

Surfshark told us in an interview that a no-logs audit is forthcoming and expected to be released by the end of 2022.

Two additional VPN security non-negotiables are DNS leak protection and a kill switch. During our tests, we detected no leaks and Surfshark's kill switch worked as expected. 

Surfshark includes additional privacy and security features like obfuscation, an ad-blocker, split-tunneling and multihop VPN connections. For an additional fee, you can add antivirus, private search and data breach alert functionality.

An intriguing new feature that Surfshark is currently in the process of rolling out is its Nexus network, which is in certain ways similar to Tor. Surfshark's Nexus network connects the VPN's entire network of servers together and allows you to route your traffic through multiple servers on the network rather than through just a single server. This is an innovative way to hide your traffic and give yourself several extra layers of protection while using the VPN.

"The benefit in this case, of both Tor and Nexus, is that [the] exit node receives the traffic from an intermediary, not from the user directly," Surfshark founder and CEO Vytautas Kaziukonis told us in an interview. "So even if you are somehow hijacking the exit node, and even monitoring entering and exiting traffic, you still are not able to determine who is the end user entering that server because what you're seeing is, you know, number two or number one who is entering it."

Using the Nexus network's Dynamic MultiHop feature is different from the traditional multihop VPN connection in that it will allow you to choose which servers on the network to connect through instead of connecting through Surfshark's preprogrammed multihop connections. The Nexus network features an IP Rotator functionality that periodically and automatically changes your IP address without disconnecting from the VPN. The Dynamic MultiHop feature and IP Randomizer (that changes your IP address each time you visit a new website) are on deck to be rolled out over the course of 2022 and 2023. 

Though the company's physical offices are located in Lithuania, the VPN now operates under the jurisdiction of the Netherlands after transferring its jurisdiction from the British Virgin Islands in 2021. While the Netherlands doesn't currently have any data retention or reporting laws that would compel Surfshark to hand over any user data, the country does have a history of flirting with data retention and surveillance measures, which could prove to be problematic for a VPN. That, along with the fact that the Netherlands is a member of the 14 Eyes intelligence-sharing alliance makes it a somewhat precarious jurisdiction to operate a privacy service out of. 

By comparison, ExpressVPN and NordVPN are headquartered in much more privacy-friendly jurisdictions -- the British Virgin Islands and Panama, respectively. In terms of encryption, Surfshark is on par with both ExpressVPN and NordVPN, with all three providers offering industry-standard AES 256-bit encryption. Each provider also offers essential security features like a kill switch and DNS leak protection, but each one also includes a handful of additional unique features like NordVPN's Onion over VPN feature and ExpressVPN's Trusted Server technology. 

And although Surfshark includes a warrant canary on its site, it doesn't offer anything in terms of an annual transparency report -- the addition of which would go a long way in providing users with a sense of trust in the VPN provider. 

Read more: How We Test VPNs