NordVPN vs Surfshark (2026): same owner, different deal — which to pick

NordVPN vs Surfshark is less of a rivalry than it looks: since 2022 they’ve belonged to the same holding company, so the choice is mostly about the deal. Surfshark is cheaper up front and allows unlimited devices; NordVPN has the longer record of independent no-logs checks and a cleaner recent history, since Surfshark disclosed a test-server breach in September 2026.

Both are paid-only services with a 30-day money-back guarantee and a 7-day trial in some cases. Below we set the facts side by side from the providers’ own pages, the auditors’ reports and news coverage, all checked on November 12, 2026. We haven’t run speed tests and don’t publish speed scores. For each provider’s full profile, see our NordVPN review and Surfshark review.

NordVPN vs Surfshark at a glance

Surfshark prices as listed on its pricing page² on Nov 12, 2026 (US, before VAT, during a Black Friday promotion). NordVPN’s site blocks automated checks, so its prices are as reported by Gizmodo on October 21, 2026¹. Promotions and renewals change often.

Are NordVPN and Surfshark the same company?

Not the same company, but the same group. In 2022 Nord Security, NordVPN’s parent, and Surfshark merged under one holding company, and both say they keep operating independently.

The February 2022 announcement on PR Newswire⁴ said the two would join forces while operating autonomously. Surfshark’s own about page⁵ says the companies “merged under one holding company” while “operating independently,” and that the merger made it a unicorn with a $1.6 billion valuation. The two keep separate legal entities: NordVPN says it is based in Panama with its parent Nord Security headquartered in the Netherlands (help center⁶), and Surfshark B.V. is registered at Kabelweg 57 in Amsterdam, per its terms of service⁷.

What “independent” means in practice is something only the companies can see. Separate apps, separate audits and separate infrastructure are real differences, but the money ends up in the same place, and strategy can be set at the top.

Which is cheaper, NordVPN or Surfshark?

Surfshark is cheaper up front: its Starter tier was listed at $2.49 a month on the 2-year plan ($67.23 for 27 months), against a reported $3.49 a month for NordVPN Basic ($94.23 for 27 months). What you’ll pay after that is clearer for NordVPN, whose reported renewal is $139.08 a year.

Surfshark’s pricing page says renewals are charged at “the applicable renewal price” but doesn’t show the amount. Its renewal policy page³ says renewals are at the standard, non-introductory rate and that prices may be A/B tested. The plan data behind the pricing page lists a Starter renewal of $79 per 12 months, but since that figure isn’t displayed to buyers, treat it as indicative and check your account before the term ends.

Shorter terms cost more per month. NordVPN Basic is reported at $5.49 a month on the 1-year plan ($65.88) and $14.99 month to month. Surfshark’s page data puts Starter at $2.99 a month for 15 months ($44.85) and $18.95 month to month, so NordVPN is the cheaper one if you only want a month.

Higher tiers bundle other products. Surfshark’s One tier was listed at the same $2.49 a month as Starter during the promotion, and One+ at $3.99 ($107.73 for 27 months). NordVPN’s Complete and Prime are reported at $4.49 and $7.49 a month on 2-year plans. If you only want the VPN, the cheapest tier of either is enough. For the wider market, see the cheapest VPNs compared.

Does NordVPN or Surfshark allow more devices?

Surfshark does: its plans allow unlimited simultaneous devices, while NordVPN allows up to 10. For most people 10 is plenty; for a large household or someone sharing with family, the cap can matter.

NordVPN’s limit is stated in its help center⁸, and Gizmodo’s pricing breakdown lists 10 devices on all three tiers. Surfshark’s pricing page² lists unlimited devices; during the 7-day trial, the limit is 3.

Which has the better no-logs record?

NordVPN has more independent checks, six against Surfshark’s two, and a longer run of them. Surfshark’s checks are recent and come with separate infrastructure and protocol audits. Neither has been shown to have handed over user activity logs.

NordVPN. Its first two no-logs assurance engagements, in 2018 and 2020, were by PwC, per Wikipedia’s summary⁹; the last four were by Deloitte. The fifth gave Deloitte access from November 18 to December 20, 2024 and covered standard, Double VPN, Onion Over VPN, obfuscated and P2P servers, according to Nord Security¹⁰. The sixth ran over a month at the end of 2025 under ISAE 3000 (Revised) and was published in February 2026, as TechRadar reported¹¹, adding that Cure53 audited NordVPN’s systems in 2025 and found no critical flaws.

Surfshark. Deloitte’s first review, dated January 2023¹², looked at server configuration and deployment, the VPN infrastructure API, the software-defined network, and staff interviews. The second, published June 16, 2025¹³ under ISAE 3000, covered standard, static and multiport servers; the full report is available to customers in their account. Beyond no-logs, SecuRing pen-tested Surfshark’s network infrastructure and found no critical vulnerabilities, with one SSL/TLS configuration issue fixed, as Surfshark reported in January 2026¹⁴. And Cure53 reviewed the architecture and cryptography of its Dausos protocol in February and March 2026: per its management summary¹⁵, nothing in the protocol itself was rated critical or high, and the most severe issues were in out-of-scope hosting.

One thing to keep in mind: both companies now use the same Big Four firm for their no-logs work. That isn’t a problem in itself, but it means the two records aren’t as independent of each other as two unrelated brands’ might be. Our five-step check explains how to read an assurance report, and the best no-logs VPNs ranks all ten providers on this evidence.

Has NordVPN or Surfshark been hacked?

Both have. NordVPN had one server breached in 2018 and disclosed it in October 2019; Surfshark had an internal test server and a proxy server breached in August and September 2026 and published a report within about a week.

NordVPN, 2018. An attacker got into one server at a data center in Finland through an insecure remote-management system the data-center provider had left, and an expired internal private key leaked. NordVPN said the server held no user activity logs. It became public when NordVPN confirmed it¹⁶ about a year and a half later. Separately, in October 2026 Nord Security patched a Windows app flaw that let a local, low-privileged attacker stop unprotected Windows services, per TechRadar¹⁷; app version 8.12.0.0 and later are fixed.

Surfshark, 2026. According to its incident report¹⁸, a suspicious event showed up in its monitoring on August 31, 2026; it was classed as an incident and contained on September 2, and the report followed on September 9. An internal test server, misconfigured by human error, was reachable from the internet. The attacker got parts of system binaries, internal configurations for some services, some build credentials that had been committed to code history, and an isolated proxy server that Surfshark says had no access to user identities, IP addresses, encryption keys or browsing traffic. Surfshark says user data, production systems and VPN services weren’t affected, that it rotated or retired every secret it identified, and that its apps weren’t altered. BleepingComputer¹⁹ covered the breach.

Surfshark also admits the alert was first treated as low-risk because it came from a test environment, calling that “a key lesson,” and promises an additional independent security audit of its broader infrastructure. As of November 12, 2026 it hadn’t named a firm or a date. If that audit matters to you, it’s reasonable to wait for it, or to start on a refundable plan and check back.

NordLynx vs WireGuard and Dausos: which protocols do they use?

Both are built around WireGuard. NordVPN runs it as NordLynx, with its own privacy layer; Surfshark offers plain WireGuard with a post-quantum layer added in its app, and is testing its own protocol, Dausos, on macOS.

NordVPN explains on its NordLynx page²⁰ that plain WireGuard needs servers to keep a static table linking users to internal IP addresses, so it added a “double NAT system” that gives every user on a server the same local address and assigns per-session addresses only while a session is active. Its protocol help page²¹ also lists OpenVPN over UDP or TCP and NordWhisper, which is meant for networks that block VPNs.

Surfshark’s protocol help page²² lists WireGuard on Windows, macOS, iOS and Android (the post-quantum layer isn’t available in manual configurations), OpenVPN over UDP or TCP on those platforms plus Linux, and IKEv2. Dausos gives each connection its own data tunnel instead of sharing one, and for now is only in the macOS App Store version of the app. For blocked networks, Surfshark’s features page²³ lists obfuscated servers and a NoBorders mode. Our WireGuard vs OpenVPN guide explains the trade-offs.

Is NordVPN faster than Surfshark?

We haven’t tested it, and a single answer would mislead you. Speed depends mostly on the distance to the server, how loaded it is, your own connection and device, and the protocol.

Both default to WireGuard-based protocols, which are lighter than OpenVPN, so either should handle streaming and video calls on a decent connection. Both have a 30-day refund window: try the server locations you’ll actually use during it, at the times you’ll use them.

Which is better for torrenting and streaming?

If you need port forwarding, neither is a good fit: NordVPN offers it only with a paid add-on, and we found no sign that Surfshark offers it at all. For streaming, we can’t verify either provider’s claims, and they change often.

NordVPN’s help article²⁴ says port forwarding works only with its Dedicated Server add-on, not on standard servers or with a Dedicated IP, and not in the macOS App Store build. Surfshark’s help center has no port-forwarding article we could find, and the feature isn’t on its features page, though its server list²⁵ does mark P2P locations. If forwarding matters, look at PIA or Proton VPN, and read the best VPNs for torrenting. A VPN doesn’t make copyright infringement legal; nothing here is legal advice.

Both advertise streaming, but using a VPN to reach another country’s catalog usually breaks the streaming service’s terms, and what works changes from week to week. See the best VPNs for streaming for what we can and can’t say.

Do NordVPN and Surfshark have free trials and refunds?

Both offer a 7-day trial in limited cases and a 30-day refund on a first purchase. Neither has a free plan.

NordVPN’s 7-day trial is available in 15 countries, including the US, UK, Canada and Australia, but only on 1- and 2-year plans of its top tiers, per its trial page²⁶. Its refund covers the first purchase of a new subscription, not renewals; App Store and Amazon purchases are refunded by those stores (terms²⁷).

Surfshark gives new users buying a 12- or 24-month plan on its website a 7-day trial on up to 3 devices (help center²⁸). Its terms⁷ limit the 30-day guarantee to the initial purchase, one refund per service, and exclude recurring payments, prepaid or gift-card payments, most reseller purchases, and anyone who already had a free trial of 30 days or more.

On features, Surfshark’s features page²³ lists a kill switch, split tunneling (which it calls Bypasser) and Dynamic MultiHop, its double-VPN option, and its servers page²⁵ says all its servers are RAM-only, in 100 countries by its own count. NordVPN’s audit scope includes Double VPN and Onion Over VPN servers. We haven’t verified NordVPN’s current server count, RAM-only status, kill switch or split tunneling from a page we could open, so we don’t compare them here.

NordVPN or Surfshark: which should you pick?

Pick NordVPN if you want the longer record of no-logs checks, a recent history without a breach, NordWhisper for networks that block VPNs, or a cheaper single month. Accept a higher reported renewal price, a 10-device cap, and that its 2018 breach took about 18 months to come out.

Pick Surfshark if you want the lower up-front price, unlimited devices for a big household, and a provider under Dutch and EU law. Accept that its renewal price isn’t shown up front, and that the independent audit it promised after the 2026 breach was still pending on November 12, 2026.

Don’t pick both to spread your risk: they share an owner. If you want a second opinion from an unrelated company, Proton VPN vs NordVPN and ExpressVPN vs Surfshark are the closest alternatives, and the comparison table lists all ten providers side by side.

Visit NordVPN Visit Surfshark