These three services have converged, and that is the honest starting point. All of them pass leak tests, all publish independent audits, all unblock the streaming catalogues people care about, and all run on every device you own. It is why different review sites crown different winners every year: on the things most comparisons measure, there is barely a gap left to measure.
So the useful question is not which one is best. It is which one is best for you, and what you give up when you choose it. The short version, before the argument: NordVPN for most people, Surfshark if you are covering a house full of devices without spending much, and ExpressVPN if you want the app that asks the least of you.
There is also something none of the three puts on its pricing page. You are choosing between three apps, but only two companies.
The six things this comparison weighs
This is research-based analysis, not a lab test. Softoto does not run speed benchmarks, and a home connection cannot honestly produce the multi-location test results some sites report. What can be checked, and what decides this comparison, is a matter of public record:
That last one usually goes unmentioned, and it turns out to be the most interesting answer of the six.
| Service | Parent company | Jurisdiction | Devices | Published no-logs audits |
|---|---|---|---|---|
| NordVPN | Nord Security | Panama | 10 | Six, by Deloitte |
| Surfshark | Nord Security | Netherlands | Unlimited | Two, by Deloitte |
| ExpressVPN | Kape Technologies | British Virgin Islands | 8 | Three, by KPMG |
Three apps, two companies
NordVPN’s parent company and Surfshark merged. Both sides said at the time that the two brands would keep running as autonomous companies on separate infrastructure with separate product plans, and by every visible sign they have. Different apps, different feature names, different engineering. But when you sit there weighing Nord against Surfshark on price, you are weighing two products from one group against each other.
ExpressVPN belongs to Kape Technologies, which also owns CyberGhost and Private Internet Access, and the publisher behind the review site vpnMentor. Kape used to be called Crossrider, and it no longer trades publicly, so the filings that once described its business are gone.
None of that means any of these services is logging you. What it means is narrower, and practical rather than alarming. The instinct to shop around, to play three rivals off against each other until one of them earns your trust, does not work the way you think here. There are two owners in this comparison, and one of them also owns a site that ranks VPNs. It also changes what a second opinion is worth: if you cross-check a verdict on three sites and one of them belongs to the company being reviewed, you have read two opinions, not three.
What each audit really examined
All three print the same no-logs promise on the same kind of homepage. What separates them is how much of that promise an outsider has been allowed to inspect, and how recently.
NordVPN has the longest record of the three. Its no-logs claim has been through six independent assurance engagements by Deloitte, carried out under ISAE 3000, the most recent covering its standard servers along with Double VPN, Onion over VPN and its obfuscated fleet. Six is not a marketing number. It means an outside team has looked at the same claim repeatedly over several years and kept finding it accurate.
Surfshark has two no-logs assurance reports from the same auditor under the same standard, plus separate infrastructure audits of its network and its newer protocol. Two is respectable. It is also a third of Nord’s record, which matters if repeated verification is the thing you are buying.
ExpressVPN has taken a different route. Its privacy commitments have been through three KPMG audits, and its technical stack has been examined more thoroughly than either rival’s: the Lightway protocol audited four separate times by two different firms, plus its apps, browser extensions and home routers. On paper it is the deepest technical portfolio in the group.
An audit describes a moment, though, and between those moments code ships. ExpressVPN shipped a Windows build containing leftover internal debug code, which quietly routed remote desktop traffic around the tunnel instead of through it. Anyone watching the network, an internet provider or someone on the same coffee shop wifi, could see the real IP address and the machine being connected to. An outside researcher caught it through the bug bounty programme, the company patched it and published the details, which is the right way to handle a mistake. It was still the second leak of its kind after an earlier split tunnelling problem with DNS requests.
Surfshark has its own asterisk, and to its credit the company writes it down. Its privacy policy states that its servers temporarily hold your user ID or IP address along with connection timestamps, deleted automatically within 15 minutes of your session ending. It is a narrow, disclosed, audited window for abuse prevention, not a scandal. It is also a window that neither of the other two describes, and if your threat model turns on that distinction, you should know it exists rather than assume it does not.
Speed, protocols and the extras
Underneath, the three are closer than the marketing suggests. NordVPN runs NordLynx, its own build on top of WireGuard. Surfshark runs WireGuard directly alongside a newer in-house protocol of its own. ExpressVPN wrote Lightway from scratch, rebuilt it in Rust, opened the source, and moved its key exchange to the post-quantum standard, which the other two have also been working toward. Nobody in this group is running anything slow or dated.
The outlets that do run these tests, VPNOverview and Cybernews among them, generally put NordVPN fastest, Surfshark close behind, and ExpressVPN steadier than it is quick. Before that decides anything, be honest about your connection. On ordinary home broadband all three will saturate what your line can carry, and the gap only opens on long-distance hops, which is a real problem if you connect from Algiers to a US server every day and a non-issue if you connect to Paris. Server counts are the weakest signal of the lot, because published totals disagree wildly between sources. What matters is whether there is a server near you and near the content you want.
The extras are where the personalities separate. NordVPN gives you a menu you operate yourself: obfuscated servers for restrictive networks, peer-to-peer servers, Onion over VPN, Double VPN, plus ad and tracker blocking. Surfshark takes the opposite approach and turns things on by default, applying obfuscation across the whole network and accepting file sharing on any server, with multi-hop and a disposable identity generator alongside. ExpressVPN keeps the surface deliberately small, one button and little else, with a password manager and identity tools bundled into its upper tiers. Whether that reads as clean or as thin depends entirely on whether you were ever going to open the settings.
What you pay in year three
The prices in every comparison table, including the ones written by people who tested these apps carefully, are first-term promotions. All three renew at a much higher standard rate, and none of them makes that number easy to find before you buy.
The shape is the same across all three. A two-year plan at a heavily discounted monthly equivalent, then an automatic annual renewal at something several times higher. Monthly plans cost multiples of the long-term rate and only make sense for a trip. Among these three, Surfshark stays cheapest at renewal, and NordVPN’s jump from intro rate to standard rate is reported as the steepest of the group, which reverses the impression the advertised prices give you. ExpressVPN, long the expensive one, restructured into tiers and now sits much closer to the other two than its reputation suggests.
Two practical consequences. Buy the long plan, then set a calendar reminder a week before it renews, because that is the moment you either accept the standard rate or move. And check the device limit against your household before you decide anything on price: Surfshark puts no cap on simultaneous connections, NordVPN allows ten, ExpressVPN eight. For one person with a laptop and a phone that difference is noise. For a family with two TVs, four phones and a games console, it is the whole decision.
All three refund inside 30 days, so the real test costs nothing but the effort of cancelling.
The pick, by situation
For most people, NordVPN is the answer. Six verifications of the same promise, the fastest connections in the tests other outlets publish, and the deepest menu of specialty servers when you need one. You pay for that with the harshest renewal price of the three and a device cap that a large household will hit.
If you are covering a lot of devices, or you simply want the lowest total cost over three years, take Surfshark VPN. You give up four years of audit history and you accept the disclosed 15-minute connection window, and in exchange you stop counting devices entirely.
Pick ExpressVPN if what you want is the least friction: the same clean app on every platform, nothing to configure, nothing to choose. You are accepting the ownership picture and a client that has now leaked traffic twice, and you are getting the most heavily audited protocol in consumer VPNs in return.
If reading the ownership section made you uneasy, that reaction is worth following. The answer then is neither Nord’s group nor Kape’s. Proton VPN publishes recurring technical audits and runs an independent free tier, and Mullvad VPN does not even want your email address. Neither will win a speed contest against NordVPN, and neither is trying to.
Whichever way you go, the install matters as much as the choice. Take the genuine build from the download page linked above and skip the sponsored search results, because counterfeit VPN software is a real and growing business. Researchers pulled more than 700 fake VPN extensions out of a single browser store, and the counterfeits are usually the better-looking listing. The same question of who deserves your trust runs through every tool that holds your credentials, which is why the password manager comparison makes a sensible next read.
