Surfshark vs ExpressVPN: Price, Speed, and Privacy Compared

Surfshark and ExpressVPN are two of the biggest names in consumer VPNs, and both have spent 2026 turning themselves into broader privacy bundles rather than simple tunnels. Surfshark is pushing a brand-new proprietary protocol called Dausos; ExpressVPN has spent several years refining its own Lightway protocol, now rewritten in Rust with post-quantum protection built in. Below is a side-by-side look at pricing, device limits, server networks, each company's own speed and streaming claims, and what each has actually proven about its no-logs promises through independent audits.

Pricing and plan tiers

Both companies now sell tiered bundles that mix the VPN with antivirus, identity protection, and other extras, rather than a single flat VPN subscription.

Surfshark's long-term plan runs 24 months (billed as 27 months with 3 free months added) and comes in three tiers: Starter, One, and One+. Surfshark's pricing page lists Starter and One at the same $2.49/mo introductory rate ($67.23 for the first 27 months), while One+ costs $3.99/mo ($107.73 for the first 27 months). All three tiers list the same bundled extras on Surfshark's plan cards — Alternative ID, scam protection, antivirus, breach alerts, identity-theft coverage for US residents, and Incogni data removal — though Surfshark's own FAQ suggests the richer extras are really concentrated in One and One+, so it's worth checking the "Compare all features" table at checkout before assuming Starter includes everything.

According to ExpressVPN's order page, its standard term is 12 months plus 3 free months (15 months total), in three tiers: Basic ($4.99/mo, $74.85 for 15 months), Advanced ($5.99/mo, $89.85), and Express Pro ($8.99/mo, $134.85). Unlike Surfshark, ExpressVPN's tiers are clearly differentiated: Basic is VPN-only (plus a small AI assistant allowance and email-alias tool); Advanced adds a password manager (ExpressKeys), an identity-monitoring product (Identity Defender) with up to $3 million in theft insurance, and a travel eSIM; Express Pro raises the AI, storage, and insurance limits again (up to $5 million) and includes a dedicated IP at no extra cost, where Basic and Advanced charge for one as an add-on.

Both companies advertise a 30-day money-back guarantee on every plan, and both renew annually after the discounted first term — Surfshark and ExpressVPN each disclose this in their pricing FAQs, though neither lists exact renewal pricing on the main pricing page.

Simultaneous device limits

This is one of the clearest differences between the two. Surfshark says every plan, including the cheapest Starter tier, covers an unlimited number of devices on a single subscription — useful for households or anyone who wants to put the VPN on a router and still cover phones and laptops separately. ExpressVPN has moved away from its old flat 8-device cap: its current tiers allow 10 devices on Basic, 12 on Advanced, and 14 on Express Pro, all still well above what most individual users need, but capped rather than unlimited.

Server network: countries and locations

Surfshark's own servers page claims 4,500+ servers spread across 100 countries and 130+ locations, including what it calls the world's first 100 Gbps server cluster in Amsterdam. ExpressVPN counts things differently: its server-location page lists 214 distinct server locations across 113 countries, but ExpressVPN does not publish a total physical or virtual server count the way Surfshark does. So Surfshark wins on raw country count only slightly (100 vs. 113 actually favors ExpressVPN), but leads clearly on total server count and locations if you take both companies' own published figures at face value.

Note the asymmetry: ExpressVPN actually claims more countries (113) than Surfshark (100), even though Surfshark's network is often assumed to be larger. Some of ExpressVPN's 214 locations are virtual, meaning the registered IP matches the chosen country while the physical server sits elsewhere — a practice both companies use to some degree and neither hides from technical users who read their own support documentation.

Speed and protocols: Dausos vs. Lightway

Both companies' speed pitches now center on in-house protocols rather than relying solely on WireGuard or OpenVPN.

Surfshark's Dausos launched in 2026 as what Surfshark calls the first VPN protocol built specifically with everyday users in mind (the name comes from a Lithuanian word for "heaven," a nod to Surfshark's Lithuanian roots). Surfshark says Dausos gives each user a dedicated, private tunnel, uses AEGIS-256X2 encryption that it claims no other commercial VPN currently uses, and layers in a hybrid ML-KEM/X25519 post-quantum key exchange designed to resist future quantum-computing attacks. Surfshark claims speeds "up to 30% faster" than other industry-standard protocols, though it publishes no independent test methodology alongside that figure. Cure53 has reviewed Dausos, according to Surfshark's protocol page, though the findings themselves aren't detailed on that page. As of now, Dausos is available only in Surfshark's macOS app, with other platforms promised "soon" but undated.

ExpressVPN's Lightway is the more mature of the two by several years and is already available across Android, iOS, Windows, Mac, Linux, and router apps. ExpressVPN rewrote Lightway's core in Rust, which it says eliminates whole classes of memory-safety bugs, and built in post-quantum protection using ML-KEM by default rather than as an opt-in extra. It also runs on wolfSSL, a cryptography library ExpressVPN says has been vetted against standards including FIPS 140-2. A "Lightway Turbo" mode uses multi-lane tunneling to push speeds higher, though ExpressVPN currently limits that specific toggle to its Windows app. Lightway's core code is open-sourced on GitHub, and Cure53 and Praetorian both audited the Rust rewrite in 2024, following earlier Cure53 reviews in 2021 and 2022.

Both companies' "fastest" language is marketing copy: Surfshark describes its network as "blazing-fast" with all servers rated at 10 Gbps, while ExpressVPN calls itself "one of the fastest" and notes it has previously been ranked top by outlets such as TechRadar and Tom's Guide. Neither of those rankings is something Pandromeda has verified independently, so treat all speed figures here as each company's own claim rather than a tested result.

Streaming and unblocking claims

Surfshark markets itself as giving "fast, throttle-free access to all popular streaming platforms," listing compatibility with services including Hulu, Disney+, Prime Video, BBC iPlayer, ESPN, HBO, and YouTube, backed by unlimited bandwidth and a note that the service "is not intended to be used as a means of copyright circumvention." ExpressVPN takes a similar line in its own support materials, framing unblocking around bypassing ISP throttling and network restrictions (such as school or office Wi-Fi) rather than making an explicit streaming-library guarantee on its main marketing pages; it also includes MediaStreamer, a Smart DNS tool, at no extra cost for devices like smart TVs and game consoles that don't support a VPN app directly. Surfshark offers a comparable Smart DNS option for the same purpose. Again, these are both companies' own positioning — actual unblocking success with any individual streaming service can and does change as platforms update their VPN-detection systems, and this article is not reporting independent test results for either service.

No-logs claims and independent audits

Both companies say they keep no activity or connection logs, and both have paid for outside firms to check that claim — the real differentiator is how recently and how publicly.

Surfshark's most recent public audit is a Deloitte assurance report, published via Surfshark's blog on June 16, 2025, which it describes as its biggest audit to date. Deloitte reviewed server configuration and deployment, the software-defined network, static and multiport servers, and staff interviews, and concluded the findings support Surfshark's no-logs claim. The full ISAE 3000 report is available to logged-in Surfshark users rather than published openly. This followed an earlier Deloitte review first reported in January 2023, plus prior audits by Cure53.

ExpressVPN's privacy policy page points to a KPMG audit of its privacy policy and the privacy protections of its server technology, though the page itself only calls the review "recent" without giving a specific date — ExpressVPN has in fact had its no-logs claims reviewed by KPMG multiple times over several years, alongside earlier PwC audits of its privacy-policy compliance and build-verification process, and separate Cure53 audits of its TrustedServer technology, apps, and Lightway protocol. ExpressVPN's own site doesn't centralize all of these with exact dates in one place, so readers who want the full audit history should check its Trust Center directly rather than relying on a single page.

In short: both are independently audited, both make a reasonable public case for it, and neither published a brand-new audit result with a firm date on the specific page we checked for this article. Surfshark's page was more explicit about timing (June 2025); ExpressVPN's required digging through multiple historical blog posts to reconstruct a timeline.

Kill switches, split tunneling, and RAM-only servers

Beyond protocols, both companies lean on similar baseline security engineering, described in their own feature pages. Surfshark's entire server network runs on RAM-only, diskless infrastructure, meaning server data is wiped whenever a machine reboots or is powered off; Surfshark's blog says it finished converting its full 4,500+-server network this way, following an initial rollout that started in 2020. ExpressVPN calls the equivalent approach TrustedServer technology, also running entirely on volatile memory so "no logs or session data remain between VPN sessions."

Both also ship a kill switch and split tunneling, though implementation details differ. Surfshark's kill switch has a Soft mode (blocks traffic only after an unexpected drop) and a Strict mode (blocks traffic any time the VPN is off, including after you manually disconnect). ExpressVPN's Internet Kill Switch (the feature ExpressVPN's own features page names; some ExpressVPN materials elsewhere call it Network Lock) blocks all internet traffic when the connection drops unexpectedly. Split tunneling on both services lets you route specific apps outside the VPN tunnel — useful for keeping a local printer or network drive reachable while everything else stays encrypted — though exact platform support for split tunneling varies by app and is worth checking against each company's current support pages before relying on it.

Which should you choose?

If unlimited device coverage and the lowest entry price matter most, Surfshark's Starter or One tier is hard to beat at $2.49/mo, especially for a household running the VPN across many devices and a router. If you want a protocol that's already cross-platform, want a slightly larger published country count (113 vs. 100), or weight ExpressVPN's longer, more thoroughly third-party-documented audit history more heavily than Surfshark's single large recent report, Express Pro's bundle of a dedicated IP, higher-tier identity protection, and Lightway's maturity across every app may be worth the higher price. Readers who've already compared Surfshark against NordVPN or looked at how ExpressVPN stacks up against NordVPN will recognize both services here as consistently mid-to-upper-tier on price and heavily focused on bundled extras rather than bare-bones VPN service. For readers who want all three major contenders side by side, Pandromeda's earlier three-way comparison with Proton VPN covers the broader field.

What next

Both companies update pricing, device limits, and protocol rollout status fairly often, so check surfshark.com/pricing and expressvpn.com/order directly before buying if exact current pricing matters. If Dausos' macOS-only limitation or the still-vague dating on ExpressVPN's most recent KPMG audit is a dealbreaker, it's reasonable to wait for Surfshark's promised cross-platform Dausos rollout or to ask ExpressVPN support directly for the latest KPMG report date before committing to a multi-year plan.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage