ExpressVPN vs. NordVPN vs. Surfshark (2022)

Winner: ExpressVPN, Surfshark, and NordVPN

I always like to make sure this point is stressed in all my VPN coverage: if you’re counting on a VPN for your physical freedom or to protect your life, it’s important that you do a lot more research than just reading an article like this. With that said, let’s look at the overall security profile for these three vendors.

NordVPN has got a lot of mileage out of its Panamanian corporate registration, claiming that Panama puts its records out of the legal reach of governments and lawyers. As I discussed in great depth in my analysis of NordSec, it’s possible that countries with Mutual Legal Assistance Treaties (MLAT) may well be able to pierce the corporate veil.

Although I didn’t do as deep an in-depth analysis of ExpressVPN, the company has similar claims and limits as Nord. ExpressVPN lists its registry in the British Virgin Islands but is a company with developers based in many MLAT countries as well.

Surfshark also has the same basic claims and limits as Nord. Surfshark lists its registry in the British Virgin Islands, but like Nord and ExpressVPN, it’s a company with developers based in many MLAT countries as well.

Surfshark boasts a private DNS service among its advanced features so you can be protected even while using public Wi-Fi whether you’re in Australia, Hong Kong, the Netherlands, the USA, or anywhere in between. Surfshark also says it passed the German company Cure53’s security audit and offers uncrackable AES-256 bit encryption alongside its strict no-logs policy, but the German audit was limited to Surfshark’s browser extensions.

All three vendors tout a no-logs policy. All three say they don’t capture VPN connection time stamps, used bandwidth, traffic logs, IP addresses, or browsing data but there are some nuances here. NordVPN says it doesn’t track used bandwidth, while ExpressVPN says it tracks the total amount of daily data transmitted each day. ExpressVPN also tracks the location of VPN servers you connect to. That’s not good, because it means they can tell where your connection originated from (or at least the country) and where you’re trying to connect to.

All three offer warrant canaries. All three also capture email addresses and billing information. NordVPN says it doesn’t track used bandwidth, while ExpressVPN says it tracks total amount of daily data transmitted each day. ExpressVPN also tracks the location of VPN servers you connect to. That’s not good, because it means they can tell where your connection originated from (or at least the country) and where you’re trying to connect to.

All three accept cryptocurrencies. This makes it safer to use apps such as PayPal and use your credit card without having fear of security breaches. ExpressVPN says it tracks the total amount of daily data transmitted each day. ExpressVPN also tracks the location of VPN servers you connect to. That’s not good, because it means they can tell where your connection originated from (or at least the country) and where you’re trying to connect to.

So, which is more secure? Honestly, they’re very close. We probably wouldn’t feel comfortable putting our lives in the hands of any of these three companies (not that they’re doing anything wrong, but just because it’s a scary concept), but we’d certainly feel reasonably comfortable letting them protect our Wi-Fi surfing when out and about.