Is Surfshark Safe? Permissions, Privacy and Ownership Checked

Is Surfshark trustworthy?

Surfshark is a real, established VPN provider rather than a fly-by-night free proxy, and nothing in its public record suggests it sells browsing data. Trust in a VPN still comes down to three things you can check yourself: who owns it, where it is legally based, and whether anyone outside the company has looked at its logging claims.

Surfshark launched in 2018 and later moved its legal base from the British Virgin Islands to the Netherlands. In 2022 it merged with Nord Security, the group behind NordVPN, while keeping its own brand, apps and infrastructure. That means your subscription money and your account data sit with a large, registered European business that falls under EU privacy law (GDPR), not an anonymous developer.

On logging, Surfshark states that it does not keep records of the sites you visit, your traffic or your connection timestamps, and it has published the results of an independent no-logs assessment by an accounting firm. Its servers run in RAM-only mode, which is designed so nothing is written to disk that could survive a reboot or a seizure. Read the current wording in the Surfshark privacy policy rather than relying on marketing pages, because policies can change.

Does the Surfshark Chrome extension protect everything?

No. The Surfshark extension routes only Chrome's own traffic through Surfshark's servers; your email client, games, Spotify, torrent client and other browsers keep using your normal connection. This is the single most common misunderstanding behind the question of whether Surfshark is safe.

Technically, a VPN browser extension works as an encrypted proxy set through Chrome's proxy settings. It changes the IP address websites see and hides which sites you visit from your Wi-Fi owner or internet provider, but only for pages loaded in that Chrome profile. The desktop and mobile apps create a system-wide tunnel with protocols such as WireGuard, OpenVPN and IKEv2, and they add a kill switch that blocks traffic if the tunnel drops.

On Windows, Mac and ChromeOS you install the extension from the Chrome Web Store; on Android and iOS, Chrome does not support extensions, so you need the Surfshark app instead. If you run the app and the extension at the same time, Surfshark's help pages recommend using one or the other, because stacking them can slow pages or cause location mismatches.

What permissions does the Surfshark extension ask for?

Check the exact list yourself on your own machine, because permission sets change between versions and we do not have a verified copy of Surfshark's current manifest. The steps below take under a minute and show you precisely what Chrome has granted.

1. Open Chrome and go to chrome://extensions.
2. Find Surfshark VPN and click Details.
3. Read Permissions and Site access. Site access set to On all sites means the extension can read and change pages you visit.
4. Scroll to Allow in Incognito and decide whether you want the VPN there; it is off by default.
5. In the Chrome Web Store listing, open the Privacy practices section to see what data the developer declares it collects.
6. Click Remove if anything you see does not match how you plan to use it.

Expect a VPN extension to ask for broad access. It has to control Chrome's proxy settings, authenticate to its servers and usually apply to every site, which is why wording like read and change all your data on all websites appears. That is the all-sites permission, and for a VPN it is normal. What would be unusual is access with no link to the job, such as reading your browsing history or your clipboard.

Access to all sites

Needed for the VPN to apply to every tab. Powerful, so only grant it to a provider you trust.

Tabs

Lets the extension see open tab URLs, often used for per-site rules. See our tabs permission guide.

Storage

Saves your login state and settings locally. Low risk on its own; details on the storage permission page.

Privacy settings

Common in VPN extensions to block WebRTC, which can otherwise reveal your real IP address.

If a later update requests a new, more sensitive permission, Chrome disables the extension until you approve it. Treat that prompt as a moment to reread the list, not a box to click through. Our full permissions directory explains every warning Chrome can show.

Why do people report hacked Surfshark accounts?

Most hijacked VPN accounts are taken over with passwords leaked from other sites, not by breaking into the VPN company. Attackers test email-and-password pairs from old breaches against popular services, a technique called credential stuffing, and sell working logins. The top Reddit thread for this search describes exactly that pattern of repeated takeovers.

A stolen VPN login mostly costs you access and possibly your subscription, since strangers use your connection slots and may change the password. It does not expose your browsing history if the provider keeps no logs, but it can expose the email, payment method details shown in the account and device list. Fix it with the steps below.

1. Sign in at the Surfshark website and change your password to a long, unique one generated by a password manager.
2. Open account settings, find Two-factor authentication and turn it on with an authenticator app, not SMS if you can avoid it.
3. Review the list of active devices and sign out any you do not recognise.
4. Check that the account email is still yours and that the password on that email account is unique too.
5. If someone changed the email or plan, contact Surfshark support from the official help centre and ask for a recovery.

What are the downsides of Surfshark?

Surfshark's weak points are practical rather than privacy-breaking: the extension's narrow scope, renewal pricing and the usual limits every VPN has. Knowing them up front stops you expecting protection it was never designed to give.

• The browser extension is partial cover. Anything outside Chrome leaks your real IP unless you run the app.
• Renewal prices are higher than first-term prices. The deal you see on the pricing page usually applies to the first billing period only.
• Shared ownership. Being part of Nord Security gives resources but also concentrates several VPN brands under one group, which some privacy users dislike.
• Streaming unblocking is not guaranteed. Services block VPN IP ranges, and success changes week to week.
• Some sites treat VPN traffic as suspicious. Expect extra captchas, Google verification checks and occasional bank security prompts.
• No protection against scams you click. A VPN does not stop phishing pages, fake downloads or malicious extensions.

The last point is the one that matters most for everyday safety. Surfshark bundles CleanWeb, which blocks some ads and known malicious domains, but a dedicated content blocker and good habits still do more of that work than any VPN.

Why is Surfshark blocked by Netflix?

Netflix and other streaming services block IP addresses they identify as belonging to VPNs, because their licences are sold country by country. When many subscribers share one Surfshark server address, it is easy for a streaming service to flag, so you see a proxy error or only the catalogue that is available everywhere.

This is a licensing issue, not a safety problem: being blocked does not mean your data leaked. If you want to try again, disconnect, pick a different server in the same country, clear the streaming site's cookies and reload. The one-click Clear Cache extension can do the cookie step if you do it often, though it clears all sites unless you change its settings.

Also check that your real location is not leaking. In the extension, confirm WebRTC protection is on, and make sure Chrome's location permission for the streaming site is set to block under Settings > Privacy and security > Site settings > Location. Keep in mind that using a VPN to reach another country's catalogue may breach the streaming service's terms, which can put your account at risk.

Why is Surfshark so cheap, and is there a free version?

Surfshark is cheap mainly because the headline price assumes a long plan paid upfront; month-to-month billing costs noticeably more. Low prices come from scale and prepaid terms, not from selling your data, which is the business model you should fear with truly free VPNs.

There is no permanent free Surfshark plan. The Chrome extension is free to install, which is why our directory lists Surfshark VPN as freemium, but it needs an active subscription to connect. Surfshark has offered a money-back window on new purchases; check the current terms before you buy, since refund rules can change and may exclude some payment methods.

Plans also allow unlimited simultaneous devices, so one subscription can cover a household. That is good value, but it is also why a stolen login gets abused quickly, so secure the account as described above.

Is Surfshark safe for banking, torrenting and public Wi-Fi?

For banking, yes: your bank connection is already encrypted with HTTPS, and Surfshark adds a layer that hides your activity from the local network. The friction comes from location, because a sudden login from another country can trigger fraud checks or a locked card.

• Banking: connect to a server in your own country, or pause the VPN for your bank's site. Never ignore a certificate warning with or without a VPN.
• Torrenting: Surfshark says it allows P2P traffic, but the Chrome extension does not cover a torrent client. Use the desktop app with the kill switch on, and follow your country's copyright law.
• Public Wi-Fi: this is where the extension shines for quick browsing on hotel, café and airport networks, as long as you only need Chrome covered.
• Hackers: a VPN hides traffic from the network, but it cannot stop you logging in to a fake page. Use a password manager, which will refuse to autofill on a lookalike domain.

One more practical safeguard: pushy pop-ups and forced redirects are a common way people end up on fake login pages while browsing through any VPN. Redirect Blocker stops many automatic redirects, with the catch that it can occasionally block a legitimate sign-in hand-off you then have to allow.

Verdict: should you use Surfshark, or an alternative?

Surfshark is safe to use if you want a paid, audited VPN that covers many devices, and its Chrome extension is a sensible add-on for quick browser-only protection. Use the desktop app for full-device privacy, turn on two-factor authentication, and check the extension's permissions after each major update.

If you would rather use a different provider, compare them on the same checklist: known owner, published policy, independent review, and permissions that match the job. Our VPN extensions hub ranks the options, and the security and privacy category covers blockers and password tools. We explain how we judge picks on our methodology page.