ExpressVPN vs Surfshark (2026): price, audits, devices, which to pick

For most people, Surfshark is the better deal and ExpressVPN the more predictable one. Surfshark costs less up front and allows unlimited devices, while ExpressVPN shows its renewal price, has its own audited protocol, and has no recent breach, whereas Surfshark disclosed one in September 2026.

Both are mainstream, paid-only services with RAM-only servers and a 30-day money-back guarantee, and each belongs to one of the two groups that own half the VPNs we cover. This comparison puts the facts side by side, from the providers’ pages, auditors’ reports and news coverage, all checked on November 12, 2026. We haven’t run speed tests and don’t publish speed scores. For each provider’s full profile, see our ExpressVPN review and Surfshark review.

ExpressVPN vs Surfshark at a glance

Prices as listed on Nov 12, 2026 on ExpressVPN’s order page¹ and Surfshark’s pricing page² (US, before tax; Surfshark was running a Black Friday promotion). Promotions and renewals change often.

Which is cheaper, ExpressVPN or Surfshark?

Surfshark is cheaper to start: Starter was listed at $2.49 a month on the 2-year plan ($67.23 for 27 months), against $2.99 a month for ExpressVPN Basic ($83.72 for 28 months). Month to month, ExpressVPN is cheaper at $14.99 against Surfshark’s $18.95.

The difference is in what happens next. ExpressVPN’s order page shows Basic renewing at $99.95 a year. Surfshark’s pricing page says renewals are charged at “the applicable renewal price” without giving the amount; its renewal policy page³ says that means the standard, non-introductory rate, and that prices may be A/B tested. The plan data behind Surfshark’s page lists a Starter renewal of $79 per 12 months, but because it isn’t displayed to buyers, treat it as indicative and check your account before the term ends.

ExpressVPN also appears to test prices on visitors. On two loads of its order page on the same day, Advanced showed $4.49 and $4.19 a month on the 2-year plan, and the page’s own data labels the Basic 2-year price as an A/B test. At the higher price, Advanced was $125.72 for 28 months, renewing at $119.95 a year, and Pro $7.49 a month ($209.72), renewing at $199.95. On 12-month terms, ExpressVPN Basic was $74.85 for 15 months and Surfshark Starter $44.85 for 15 months, per its page data.

Surfshark’s higher tiers bundle extra products: One was listed at the same $2.49 a month as Starter during the promotion, and One+ at $3.99 ($107.73 for 27 months). ExpressVPN’s higher tiers add devices and, on Pro, a dedicated IP. For the wider market, see the cheapest VPNs compared.

Does ExpressVPN or Surfshark allow more devices?

Surfshark: unlimited simultaneous devices on every plan. ExpressVPN allows 10 on Basic, 12 on Advanced and 14 on Pro.

Surfshark’s pricing page² lists unlimited devices, with the 7-day trial capped at 3. ExpressVPN’s limits are on its order page¹; its Pro tier includes a dedicated IP, which is an optional add-on on Basic. If you need more than 10 devices, Surfshark covers you at its cheapest price, while ExpressVPN asks you to move up a tier.

Which has the better no-logs record?

It’s a different kind of evidence on each side. ExpressVPN has a server seizure that turned up nothing and a 2025 KPMG report on how its controls were designed; Surfshark has two Deloitte no-logs reports plus recent infrastructure and protocol audits. Neither has been shown to have handed over user activity logs.

ExpressVPN. KPMG examined its TrustedServer system and privacy-policy claims as of February 28, 2025 under ISAE (UK) 3000 and gave reasonable assurance, published in June 2025⁴. It’s a “Type 1” engagement, checking how controls were designed at one moment rather than how they ran over months. The stronger evidence is from 2017, when Turkish authorities seized an ExpressVPN server while investigating the assassination of Russia’s ambassador; ExpressVPN said it keeps no connection or activity logs and the inspection found nothing useful, as TorrentFreak reported⁵. ExpressVPN counts its audits across all its products and reached 27 independent audits⁶ by June 2026.

Surfshark. Deloitte’s first review, dated January 2023⁷, covered server configuration and deployment, the VPN infrastructure API, the software-defined network, and staff interviews. The second, published June 16, 2025⁸ under ISAE 3000, covered standard, static and multiport servers; customers can read the report in their account. SecuRing then pen-tested Surfshark’s network infrastructure and found no critical vulnerabilities, with one SSL/TLS configuration issue fixed, as Surfshark reported in January 2026⁹.

Has ExpressVPN or Surfshark been hacked?

Surfshark has: an internal test server and a proxy server were breached in August and September 2026. We found no comparable breach of ExpressVPN’s servers; its controversy is about a former executive.

According to Surfshark’s incident report¹⁰, a suspicious event appeared in its monitoring on August 31, 2026; it was classed as an incident and contained on September 2, and the report followed on September 9. A test server, misconfigured by human error, was reachable from the internet. The attacker got parts of system binaries, internal configurations for some services, some build credentials that had been committed to code history, and an isolated proxy server that Surfshark says had no access to user identities, IP addresses, encryption keys or browsing traffic. Surfshark says user data, production systems and VPN services weren’t affected, that it rotated or retired every secret it identified, and that its apps weren’t altered; BleepingComputer¹¹ covered it. Surfshark promised an additional independent audit of its broader infrastructure but, as of November 12, 2026, hadn’t named a firm or date.

ExpressVPN’s issue is different. In 2021 Daniel Gericke, then its chief technology officer, entered a deferred prosecution agreement with the US Justice Department over hacking work he did for the United Arab Emirates before joining, and ExpressVPN kept him in the role, as Euronews and Reuters reported¹². It didn’t involve ExpressVPN’s customers; whether it matters to you is a judgment call.

Who owns ExpressVPN and Surfshark?

ExpressVPN belongs to Kape Technologies, which also owns CyberGhost and Private Internet Access. Surfshark shares a holding company with Nord Security, NordVPN’s parent, since 2022.

ExpressVPN runs under British Virgin Islands law, and its privacy policy¹³ (updated October 2, 2026) names Kape Technologies PLC as the ultimate holding company. Kape, called Crossrider until 2018, bought ExpressVPN in 2021 for about $936 million, per The Register¹⁴. Some people avoid Kape brands because of Crossrider’s past in browser-extension software; others judge each brand on its own audits.

Surfshark B.V. is registered in Amsterdam, per its terms of service¹⁵. Its about page¹⁶ says it merged with Nord Security “under one holding company” while “operating independently,” matching the 2022 announcement¹⁷. So if you’re choosing a second VPN to avoid relying on one company, ExpressVPN and Surfshark at least come from different groups; NordVPN and Surfshark don’t.

Lightway vs WireGuard: which protocol is better?

Both are modern and fast by design. Surfshark uses standard WireGuard (with a post-quantum layer in its apps); ExpressVPN uses Lightway, its own open-source protocol, and is the only big provider we cover without WireGuard.

ExpressVPN offers Lightway on every app and router, plus OpenVPN and IKEv2 in some automatic setups, and says plainly¹⁸ it doesn’t support WireGuard. Lightway was rewritten in Rust, and Praetorian and Cure53 audited the new code in late 2024 and found nothing critical, per ExpressVPN’s February 2025 post¹⁹.

Surfshark’s protocol help page²⁰ lists WireGuard on Windows, macOS, iOS and Android (the post-quantum layer isn’t in manual configurations), OpenVPN over UDP or TCP on those platforms plus Linux, and IKEv2. Its own protocol, Dausos, gives each connection a separate data tunnel and is so far only in the macOS App Store app. Cure53 reviewed Dausos in February and March 2026; per its management summary²¹, nothing in the protocol itself was rated critical or high, and the most severe findings were in out-of-scope hosting. If you want to set up WireGuard on a router or a third-party client, Surfshark supports it and ExpressVPN doesn’t. Our protocol guide explains the differences.

Is ExpressVPN faster than Surfshark?

We haven’t tested it, and nobody can give you one answer that holds for every connection. Speed depends mostly on the distance to the server, how busy it is, your own line and device, and the protocol.

Both default to lightweight modern protocols (Lightway and WireGuard) rather than older, heavier OpenVPN, so either should cope with streaming and video calls on a decent connection. Use the 30-day refund window to test the server locations you’ll actually use.

Which is better for streaming and torrenting?

Neither stands out on what we can verify. Both advertise streaming, but providers’ “works with” claims change often, and using a VPN to reach another country’s catalog usually breaks the streaming service’s terms.

For torrenting, port forwarding is the feature that matters, and neither does it well. ExpressVPN offers it only in its router app, where forwarded ports sit outside the VPN tunnel (support page²²). We found no port-forwarding article in Surfshark’s help center and it isn’t on its features page, though its server list²³ marks P2P locations. If forwarding matters, look at PIA or Proton VPN, and read the best VPNs for torrenting and for streaming. A VPN doesn’t make copyright infringement legal; nothing here is legal advice.

Do ExpressVPN and Surfshark have RAM-only servers and the usual features?

Yes, by their own accounts: both say their servers run entirely in RAM, so nothing is kept on disk across a reboot, and both list a kill switch and split tunneling.

ExpressVPN’s features page²⁴ describes TrustedServer, which runs on volatile memory and wipes server data on every reboot, plus an Internet Kill Switch and split tunneling, with servers in 113 countries by its count. Surfshark’s servers page²³ says all its servers are RAM-only, in 100 countries by its count, and its features page²⁵ lists a kill switch, split tunneling (Bypasser), a double-VPN option (Dynamic MultiHop), obfuscated servers and NoBorders for restricted networks. These are the providers’ descriptions; RAM-only is something an audit can check, but we haven’t.

Do ExpressVPN and Surfshark have free trials and refunds?

Both refund within 30 days on a first purchase. Only Surfshark has a free trial of the paid service; ExpressVPN’s team offers a separate free app instead.

Surfshark gives new users on 12- or 24-month plans bought on its website a 7-day trial on up to 3 devices (help center²⁶). Its terms¹⁵ limit the 30-day guarantee to the initial purchase, one refund per service, and exclude recurring payments, prepaid or gift-card payments, most reseller purchases, and anyone who already had a free trial of 30 days or more.

ExpressVPN refunds first-time users who ask support within 30 days, per its order page¹. Its team launched EventVPN, a free, ad-supported app on the Apple App Store, in 2025, as Tom’s Guide reported²⁷. A 2026 Cure53 test of EventVPN²⁸ found one critical issue (Premium could be unlocked with fake transactions) and high-severity issues including IPv6 traffic bypassing the VPN, all marked fixed in the report. For more free options, see the best free VPNs.

ExpressVPN or Surfshark: which should you pick?

Pick Surfshark if price and devices come first: it’s cheaper up front, allows unlimited devices, lets you try it for 7 days, and supports standard WireGuard for routers and manual setups. Accept that its renewal price isn’t shown and that the audit it promised after the 2026 breach was still pending on November 12, 2026.

Pick ExpressVPN if you want a renewal price you can see before you buy, a cheaper single month, its audited Lightway protocol on routers and every app, and a seized server that yielded nothing as part of its record. Accept Kape’s ownership, the Gericke case, a 10-device cap on Basic, and no WireGuard.

If neither fits, NordVPN vs ExpressVPN and Proton VPN vs Surfshark cover the closest alternatives, and the comparison table lists all ten providers side by side.

Visit ExpressVPN Visit Surfshark