Surfshark is a VPN app. When you switch it on, it encrypts everything your device sends and passes it through one of Surfshark's servers before it reaches the open internet. Your internet provider and anyone else on the same network see encrypted data going to Surfshark, and the sites you visit see the server's IP address instead of yours. The details below come from Surfshark's own site, checked on November 4, 2026.

What happens when you press connect

You open the app and either pick a location or use quick connect. The app chooses a protocol, agrees on encryption keys with the server and opens a tunnel. From then on, your device encrypts every packet before it leaves. The Surfshark server decrypts it, sends the request to the website for you and returns the reply through the same tunnel. Because the server makes the request, the site records the server's address and location.

Surfshark's servers also sit inside a wider network it calls Nexus, which decides where your traffic enters and leaves Surfshark's network.

The protocols Surfshark uses

A protocol is the set of rules the app and the server use to build the tunnel. The protocol setting is automatic by default, and Surfshark says it picks the best one for your network, which in many cases is WireGuard. You can change it under Settings, then VPN settings, then Protocol.

  • WireGuard is a lean modern protocol of about 4,000 lines of code, which Surfshark says makes it fast and leaves less room for bugs. In the macOS, Android and Linux apps, Surfshark adds post-quantum protection to it by default. That protection does not apply if you set up WireGuard manually.
  • Dausos is Surfshark's own protocol, with AEGIS-256X2 encryption and post-quantum cryptography. For now it is only in the macOS app.
  • IKEv2 reconnects quickly when your phone switches networks, which is why mobile users like it. It is no longer in the Windows app, although you can still set it up by hand in Windows' own VPN settings.
  • OpenVPN is the oldest and bulkiest of the four, and it works with the widest range of routers.

Across these protocols, Surfshark lists AES-256-GCM, ChaCha20 and AEGIS-256X2 as its encryption standards. Post-quantum protection aims to keep traffic recorded today safe from quantum computers that could break current key exchange methods later.

How your IP address and location change

Your internet provider gives your connection an IP address that points back to your home or your phone's network. With Surfshark on, sites see the address of the Surfshark server instead. Pick a server in Japan and you appear to be in Japan. On November 4, 2026, Surfshark listed more than 4,500 servers in 100 countries and more than 130 locations, each on a 10 Gbps port.

Most addresses are shared by many users. Surfshark also has static IP servers, which give you the same address each time you connect, and a dedicated IP, an address only you use, for an extra fee in 20 locations.

Nexus: servers joined into one network

Most VPNs link you to one server at a time. Surfshark's Nexus uses software-defined networking to join its servers into one global network. You choose an exit location, Surfshark connects you to the nearest Nexus entry point and gives you an IP address in the location you chose. Three features run on it:

  • Rotating IP changes your IP address every five minutes within your chosen location, without disconnecting your apps.
  • Multi Hop sends your traffic through two servers. You can pick a ready-made pair or build your own entry and exit.
  • FastTrack adjusts your route to cut delay in busy locations such as Seattle, Vancouver and Sydney.

A tunnel can drop when Wi-Fi flickers or your laptop wakes from sleep. Without protection, your device carries on over your normal connection and shows your real address. Surfshark's kill switch cuts your internet when you are not connected to a VPN server, on Windows, macOS, Linux, iOS and Android. It has two modes. Soft mode steps in only when the connection drops unexpectedly. Strict mode blocks internet access any time the VPN is off, even if you disconnected on purpose. Surfshark's setup steps have you switch it on in the VPN settings, so check it is on after you install.

Everlink works on the same problem from the other side: when a connection drops, it restores it straight away so you stay protected.

Bypasser, CleanWeb and NoBorders

Bypasser is Surfshark's name for split tunneling. It lets you choose apps or websites that skip the VPN, such as a bank site that rejects VPN addresses, on Windows, macOS, Android and iOS, and websites only in the Chrome, Firefox and Edge extensions. Reverse Bypasser flips it, so only the apps and sites you choose use the VPN.

CleanWeb blocks ads, trackers and malicious websites, and it comes with every Surfshark plan. In the apps it works only while you are connected. The browser extension also works without the VPN and can hide cookie pop-ups.

NoBorders is for restricted networks. When the app detects one, it shows you a list of servers that work best there and connects you to the closest. You can also switch it on by hand under Settings, in the Advanced tab. Surfshark's obfuscated servers do a related job, disguising VPN traffic so your internet provider cannot tell you are using a VPN.

What Surfshark says it keeps

Surfshark says it does not log what you do online, including the sites you visit, the files you download and the apps you use. It does keep your email address, an encrypted password, basic billing details and order history, plus minimal information about your connection to its servers so it can run the service and fix performance problems.

Deloitte checked the no-logs policy in 2023 and again in 2025, and Cure53 carried out Surfshark's first independent audit in 2018. All of Surfshark's servers run from RAM only, so every reboot wipes them. The company, Surfshark B.V., has its registered address in Amsterdam, and Surfshark says the Netherlands does not require companies to store or report user data. Surfshark launched its VPN in 2018 and in 2022 merged with Nord Security, the company behind NordVPN, under one holding company. Surfshark says the two still operate independently.

What a VPN does not hide

The tunnel moves trust from your internet provider to Surfshark, because Surfshark's servers carry your traffic. Sites you sign in to still know who you are, and cookies can still track you across sites. A VPN will not stop you from typing a password into a phishing page, although CleanWeb blocks some known bad sites.

Streaming services block VPN addresses they spot, so a server that works this month may not work next month. Some countries restrict VPN use by law, so check before you travel.

Devices, apps and the free trial

Surfshark sets no limit on how many devices you connect at the same time. It has apps for Windows, macOS, Linux, iOS, Android, Fire TV and Apple TV, and extensions for Chrome, Firefox and Edge.

The 7-day free trial covers the 1-year and 2-year plans. You need a credit card, PayPal or Apple Pay to start it, and you can protect up to three devices during the trial. After it ends, Surfshark's 30-day money-back guarantee still applies.

Is Surfshark the right VPN for you

Surfshark suits households with lots of devices and anyone who wants extras such as Rotating IP and Multi Hop inside the main app. If post-quantum protection matters to you, check your devices first: Surfshark's protocol page lists it for WireGuard on macOS, Android and Linux and for Dausos on Mac, but not for Windows or iPhone. You can see plans and prices on our Surfshark listing, or compare it with NordVPN, ExpressVPN and IPVanish, which also sets no device limit.