Surfshark ships more features than any rival at its price, which makes choosing a plan confusing. Here are the six that matter, and which of the three tiers you need.
Updated October 20266 features reviewedHow we test
Callum HargreavesCallum writes about screens, cameras, networks and software. He reads the spec sheet before the press release.
Surfshark’s pitch is volume. Where most providers ship a VPN and a kill switch, Surfshark ships a VPN, an ad and tracker blocker, split tunnelling in two directions, a double-hop mode, a rotating IP address, a fake identity generator, an antivirus and a breach-monitoring service. Working out which of those you will actually use is the hard part.
It also allows unlimited simultaneous connections, which quietly removes the most annoying constraint in the category: you never have to log a device out to log another in. This guide covers the six features that justify the subscription, what each one truly does, and which of the three plan tiers you need to get it.
Straight to it Turn on CleanWeb the day you install it, because it improves every page you load. If you need the VPN to stay out of the way of banking apps or local services, read Bypasser next.
Surfshark’s unlimited-device policy is the single feature that separates it from almost every rival. Image: Pexels
Affiliate disclosure: Reviews Lounge earns a commission when you buy through links on this page, at no additional cost to you. Commissions never influence our rankings, scores or recommendations. Full disclosure.
The shortlist
The best of the range
These three are the features you will use every day rather than once a year.
Best overall
CleanWeb
★★★★★4.9/ 5
Ad blockingAnti-phishingAll tiers
Blocks ads, trackers, malware and phishing attempts at the network level, so every browser and app on the device benefits without an extension, including the ones that cannot run one.
Surfshark’s split tunnelling. Nominate apps and websites to be excluded from the VPN, or use Reverse Bypasser to send only your chosen apps through it and leave everything else alone.
Routes your traffic through two VPN servers at once, with entry and exit points you pick yourself, so no single server sees both who you are and where you went.
Three reasons, and the first one is the one people actually notice.
Unlimited simultaneous connections
Surfshark places no cap on how many devices can use one subscription at the same time. In a household with two adults, two children, a television, a router and a handful of tablets, that is the difference between a VPN you use and a VPN you keep turning off. Almost every competitor counts licences; Surfshark does not.
Security features bundled, not sold separately
CleanWeb blocks ads, trackers, malware and phishing attempts as part of the VPN rather than as an add-on. Alternative ID, which generates a new online identity and a proxy email, is included with all Surfshark bundles. You are not assembling a privacy stack from four vendors and four renewal dates.
Features aimed at real-world networks
Obfuscated servers hide the fact you are using a VPN at all, NoBorders detects restricted networks and suggests servers that work on them, and the patented Everlink technology restores dropped tunnels instantly to limit IP leaks. These are the features that matter on hotel Wi-Fi rather than in a specification table.
Buying guide
How to choose the right one
Three decisions, in this order.
1
Pick the tier by the products, not the price
Surfshark sells three plans: Starter, One and One+. Starter is the VPN with its full feature set plus Alternative ID. One adds the rest of the suite — Antivirus, Alert breach monitoring and the ad-free Search engine. One+ adds data removal through Incogni. Work out which products you would otherwise pay for separately: if you already run antivirus you trust, Starter is the plain answer, and if you are consolidating subscriptions, One+ is cheaper than it looks. All tiers are offered monthly, annually and on two-year terms.
2
Set up Bypasser before you decide the VPN is annoying
Most people who abandon a VPN do so because something broke – a banking app refused to load, a streaming service complained, a local printer disappeared. Bypasser is Surfshark’s split tunnelling: you nominate apps and websites to be excluded from the tunnel, and everything else stays protected. Reverse Bypasser inverts it, sending only chosen apps through the VPN and leaving the rest alone. Spend ten minutes on this during setup and the VPN stops being something you switch off.
3
Layer the privacy features by how much speed you will trade
Each additional layer costs something. Dynamic MultiHop routes you through two servers with entry and exit points you choose, which is a meaningful privacy gain and a real latency cost. Rotating IP changes your address every few minutes without dropping the connection, which defeats IP-based tracking but can confuse sites that expect a stable session. Kill Switch is the exception: it costs nothing until the VPN drops, at which point it cuts your connection rather than leaking. Leave the kill switch on permanently and reach for the other two deliberately.
🧰 Features worth finding in the settings
Several of the most useful options are not on the front screen. Auto-connect establishes the tunnel the moment a device reaches a network, which is the only way a VPN protects you on public Wi-Fi reliably. Pause VPN suspends protection for five minutes, thirty minutes or two hours and then resumes automatically, which is far better than switching off and forgetting.
Also worth knowing: the Cookie pop-up Blocker rejects consent banners in Chrome, Firefox and Edge; GPS override on Android aligns your reported GPS location with your server location; and Static IP and Dedicated IP exist if a service you use objects to shared addresses.
🔍 What we could not confirm
Surfshark’s own pages quote a server count and the marketing quotes several different figures across regions, so we have deliberately not stated one here. Treat any specific server number you read, including on review sites, as unverified unless it comes from Surfshark’s live infrastructure page on the day you read it.
The same applies to pricing. Surfshark discounts heavily on long terms and prices differ by country, plan and promotion, so the only reliable figure is the one in your own checkout. The company offers a 30-day money-back guarantee and states that its no-logs policy has been independently audited.
In-depth reviews
All 6, reviewed
Ranked by how well each one delivers on what it promises, not by price.
1
Best overall
CleanWeb
★★★★★4.9/ 5
4.9Score
The one feature you should enable on day one, because it quietly improves every single page you load afterwards.
Our take
CleanWeb is Surfshark’s blocking layer and it is the feature with the broadest daily effect. It blocks advertisements, banners and pop-ups, along with trackers, malicious websites and phishing attempts, and it does so as part of the VPN connection rather than as a browser extension. That distinction matters more than it sounds: a network-level blocker covers every application on the device, including apps with embedded web views that an extension can never reach, and it carries on working inside those browsers whose own extension support is poor or missing altogether.
The side effects are the usual ones for any blocker and worth knowing in advance. A small number of sites detect blocking and object, some login flows that route through advertising or analytics domains break, and occasional false positives will stop a page you wanted. Surfshark pairs it with a separate Cookie pop-up Blocker for consent banners on Chrome, Firefox and Edge, which is a different feature doing a different job. If a site misbehaves, CleanWeb is the first thing to toggle off, well before you blame the VPN connection itself.
Blocks: ads, trackers, malware, phishing
Scope: network level, all apps
Availability: every plan tier
Related feature: Cookie pop-up Blocker
Pros
Works across every app, not just browsers with extension support
Covers security threats as well as advertising clutter
Reduces page weight and data use noticeably on ad-heavy sites
Cons
Occasional false positives will break a page you wanted
We may earn a commission from this link, at no extra cost to you.
2
Best for keeping apps working
Bypasser
★★★★★4.9/ 5
4.9Score
This is the setting that stops you turning the VPN off, which makes it the most valuable one in the client.
Our take
Bypasser is split tunnelling with a better name. You choose specific apps and websites to be removed from the VPN tunnel, and everything else stays protected. The problem it solves is the reason most people stop using a VPN at all: a banking app that refuses a foreign IP address, a local network printer that vanishes, a work tool tied to an office address, a streaming service that insists you are in the wrong country. Without split tunnelling the only remedy is disconnecting entirely, at which point nothing is protected.
Reverse Bypasser inverts the logic, sending only your chosen apps and sites through the VPN and leaving all other traffic untouched. That is the right configuration when you want the VPN for one specific activity and do not want your whole connection routed abroad. Worth being clear about the trade-off: anything you exclude is actually unprotected, so an exclusion list should be short, deliberate and reviewed occasionally. Available by app or by website depending on the platform, with some variation in how granular the controls are between the mobile and desktop clients.
Function: split tunnelling, by app or site
Inverse mode: Reverse Bypasser
Best used: during initial setup
Caveat: excluded traffic is unprotected
Pros
Fixes the exact problems that make people abandon VPNs
Works in both directions, including VPN-only-for-chosen-apps
Keeps local network devices such as printers reachable
Cons
Everything on the exclusion list is actually unprotected
Granularity differs between desktop and mobile clients
Easy to forget what you excluded six months earlier
We may earn a commission from this link, at no extra cost to you.
3
Best for serious privacy
Dynamic MultiHop
★★★★★4.6/ 5
4.6Score
Two servers instead of one means no single machine in the chain knows both your address and your destination.
Our take
Dynamic MultiHop is Surfshark’s double-VPN implementation, connecting you through two servers simultaneously. The privacy argument is structural rather than cryptographic: with a single hop, one server sees both your real IP address and your destination. With two, the entry server knows who you are but not where you went, and the exit server knows the destination but not who asked. Surfshark’s version is dynamic, meaning you choose the entry and exit countries yourself rather than picking from a short list of fixed pairs, which is more flexible than most competing implementations.
Everything about it costs speed. Two encrypted hops means more latency and lower throughput, which you will notice on video calls and in anything latency-sensitive. It is therefore a deliberate mode rather than a default: sensible when you are working on something sensitive, on a network you distrust, or when you want to separate your apparent location from your entry point. For streaming and everyday browsing, a single hop with the kill switch on is the better trade. Pair it with obfuscated servers if the network you are on actively blocks VPN traffic.
Function: two VPN servers in sequence
Control: choose entry and exit points
Cost: higher latency, lower throughput
Pairs well with: obfuscated servers
Pros
No single server sees both your identity and your destination
You choose both ends rather than using fixed pairs
Genuinely useful on networks you have reason to distrust
Cons
Noticeably slower than a single hop, especially on latency
We may earn a commission from this link, at no extra cost to you.
4
Best for sign-ups
Alternative ID
★★★★★4.8/ 5
4.8Score
The cheapest form of breach protection is not being in the database, which is precisely what this does.
Our take
Alternative ID generates a brand-new online identity – a name and supporting details – plus a proxy email address, and it auto-fills sign-up forms with that generated data instead of your own. The logic is prevention rather than cure. Most personal data leaks are not failures of your security but of somebody else’s, and the only reliable defence against a retailer losing your details is for the retailer never to have had them. Marketing email lands in the proxy inbox, and when a site turns out to be a nuisance you abandon the identity rather than negotiating with an unsubscribe link.
It is included at no extra cost with all Surfshark bundles, including the entry tier, which is unusual, competitors generally reserve identity features for their top plans. The limits are worth understanding. An Alternative Number, which does the same job for a phone number, is sold separately rather than included. And generated details are for sites that have no legitimate need for your real information: using them where accuracy matters, such as anything financial, contractual or involving a delivery to your door, will create problems rather than solve them.
Generates: name, details and a proxy email
Availability: included with all bundles
Sold separately: Alternative Number
Best use: untrusted sign-ups and one-off accounts
Pros
Keeps your real details out of databases that will eventually leak
Auto-fill makes it faster than typing your own details
Included on every plan tier, not just the premium ones
Proxy email contains marketing instead of forwarding it to you
Cons
The matching virtual phone number costs extra
Useless and counterproductive where real details are required
Managing multiple identities gets confusing over time
We may earn a commission from this link, at no extra cost to you.
5
Best for anti-tracking
Rotating IP
★★★★★4.5/ 5
4.5Score
A moving IP address is harder to profile than a static one; and harder for your bank’s fraud system to accept.
Our take
Rotating IP, part of Surfshark’s Nexus server technology and also presented as IP Rotator, changes the public address assigned to you every few minutes while the VPN connection stays up. That last detail is the clever part: conventional address changes require disconnecting and reconnecting, which interrupts everything. Here the tunnel persists and only the exit address moves, so from a tracking perspective your session fragments into a series of unrelated-looking visitors while your actual browsing continues uninterrupted. Ordinary VPN use hands you one address for an entire session, which is a stable identifier even though it is not your own; this removes the identifier without removing the tunnel.
It is a browsing feature, not a general-purpose one, and should be treated that way. Anything holding a session against your address will react badly to it moving mid-flow. Banking sites may force a re-authentication or flag the session for fraud, checkout processes can fail between basket and payment, multiplayer games drop, and some streaming platforms interpret the change as account sharing. The sensible pattern is to enable it for research, reading and general browsing, and switch it off before you do anything transactional. Surfshark’s Everlink technology, which restores dropped tunnels instantly, complements it well.
Function: changes IP every few minutes
Connection: stays up throughout
Technology: part of Surfshark Nexus
Avoid for: banking, checkout, gaming
Pros
Defeats address-based tracking without interrupting your connection
No reconnection, so nothing visibly restarts
Genuinely distinctive, few competitors offer it
Pairs well with CleanWeb for a low-trackability browsing setup
Cons
Breaks anything that expects a stable session address
Can trigger fraud flags on banking and payment sites
We may earn a commission from this link, at no extra cost to you.
6
Best bundle value
Surfshark One Suite
★★★★★4.5/ 5
4.5Score
Judge the bundle on what you would otherwise pay for separately, not on the length of the feature list.
Our take
Surfshark One is the plan tier that turns the VPN into a small security suite. Antivirus provides conventional device protection covering files and webcam access, designed as a set-and-forget product. Alert monitors your email addresses, identity documents and payment cards and notifies you when they appear in a leak. Search is an ad-free search engine that does not build a profile from your queries. One+ goes a step further by adding Incogni, a data-removal service that files requests with data brokers on your behalf. All three tiers are sold on monthly, annual and two-year terms with a 30-day money-back guarantee behind them.
The honest way to assess this is arithmetic, not enthusiasm. If you already pay for antivirus you trust and a breach-monitoring service, the bundle is very likely cheaper than both renewals. If you use neither, you are buying products you were content to live without, and the entry tier plus a reputable free antivirus is the more rational choice. On capability, be realistic: these are competent, well-integrated tools rather than category leaders, and a dedicated antivirus from a specialist vendor will test better. The value is in consolidation; one subscription, one app, one renewal date.
One adds: Antivirus, Alert, Search
One+ adds: Incogni data removal
Terms: monthly, annual, two-year
Guarantee: 30-day money-back
Pros
Consolidates three or four subscriptions into one renewal
Alert breach monitoring covers cards and IDs, not just emails
Antivirus is set-and-forget for non-technical households
One+ adds data-broker removal, which few VPN bundles include
Cons
Each component is competent rather than best in class
Poor value if you would not otherwise buy antivirus at all
More products means more to configure and more to ignore
We may earn a commission from this link, at no extra cost to you.
Methodology
How we judged them
We assess products on construction and claims we can verify – not on which brand pays most.
Claims checked against spec
We test marketing claims against the actual published construction and specification, rather than taking a product name at face value.
Like for like within a range
Every product in a guide is judged against its siblings, so the ranking reflects what you actually choose between.
Certification and durability
Independent certification, materials and build quality all feed into the score, not just headline features.
Matched to real people
A score means nothing without context, so every pick states who it suits — and who should skip it.
Total cost of ownership
We weigh what's included and what isn't, because delivery, fees and accessories change the real price.
No sponsored rankings
Brands cannot buy a position. Affiliate commissions fund the site but never determine the order or the wording.
FAQ
Frequently asked questions
What is the difference between Starter, One and One+?
Starter is the VPN itself with the full feature set, CleanWeb, Bypasser, MultiHop, Rotating IP, Kill Switch and the rest; plus Alternative ID, which is included with all bundles. For most people who simply want a good VPN, that is the right plan.
One adds the wider security suite: Surfshark Antivirus for device protection, Alert for data-breach notifications on your email addresses, IDs and cards, and Search, an ad-free private search engine. One+ adds Incogni, a data-removal service that contacts brokers on your behalf. Each step up only makes sense if you would otherwise buy those products separately.
Does Surfshark really allow unlimited devices?
Yes, unlimited simultaneous connections is a standing feature of the subscription rather than a promotion. One account covers every phone, laptop, tablet, television and router in a household at the same time.
The practical limits are elsewhere: each device still needs a supported app or manual configuration, and a router counts as one connection while covering everything behind it. For families and shared houses this is the single strongest argument for Surfshark over its rivals.
What exactly does Alternative ID do?
Alternative ID generates a brand-new online identity, a name and associated details, together with a proxy email address you can use on sites you do not trust. Sign-up forms get the generated data instead of your real information, and the proxy email absorbs the marketing that follows.
Its value is containment: when one of those sites is breached, the data exposed is not yours. An Alternative Number, a virtual phone number for the same purpose, is sold separately from the main plans rather than included.
Is Rotating IP a privacy upgrade or a nuisance?
Both, depending on what you are doing. It changes your IP address every few minutes without dropping the VPN connection, which makes long-term tracking by address far harder and is actually useful for general browsing.
It will, however, interrupt anything that expects a stable session. Banking, checkout flows, multiplayer games and some streaming services react badly to an address that moves mid-session. Enable it for browsing and turn it off for transactions.
So which plan, and which features?
Start on the tier whose bundled products you would otherwise buy separately. Turn on CleanWeb and the kill switch permanently, configure Bypasser during setup, and keep MultiHop and Rotating IP for when you specifically want them rather than leaving both on.
See current Surfshark plans
Feature names and behaviour checked against Surfshark’s own documentation · Server counts and pricing deliberately omitted
From the best-selling Classic to the adjustable Solaire and the pain-focused Rx, we compared every mattress in Saatva's lineup and matched each one to a sleep style, body type and budget.
Samsung's 2026 range runs from a 165Hz QD-OLED flagship to a Micro RGB LCD and an art panel that hides in plain sight. Here's which one belongs in your room.
