About our VPN recommendations:
Posted by tomspark
Why we recommend Surfshark — and how to check that recommendation yourself I got tired of VPN recommendations that are really just payout rankings, so I built a thing that measures something checkable instead: is anyone still maintaining the software you're paying for? It's live here → https://vpnupdates.app/ Every day at 5 PM Pacific it checks every app each VPN provider ships — iOS, Android, Windows, macOS, Linux, browser extensions — against public app stores and package registries, and records what it finds. No opinions, no reviews. Just a release log, made readable. Why update history matters A VPN client isn't a normal app. It installs network drivers, rewrites your routing table, and on most systems runs as administrator or root. Your entire connection goes through it. And it can't sit still. It bundles OpenSSL and WireGuard — when those get security patches, somebody has to ship the patched version to you. An abandoned client keeps shipping the vulnerable one forever. Meanwhile Apple reworks network extensions, Android raises API requirements, Windows changes driver signing. The uncomfortable part: abandoned doesn't look abandoned. The website stays up. The marketing still says military-grade encryption. Support still replies. The app still connects. The card still gets charged. Right now, 4 of the 28 providers I track haven't shipped an update on any platform in six months — and every one of them is still selling subscriptions. So why Surfshark It's 1 on the index at 70.0 out of 100 — but the number isn't the interesting part. This is: iOS 2 days ago Chrome 4 days ago Android 7 days ago Windows 10 days ago macOS 12 days ago Firefox 25 days ago Six platforms, and the oldest thing they've touched is 25 days. 44 releases in the last twelve months. That matters more than it sounds, because the most common trick in this space isn't lying — it's neglect you can't see. Providers ship six or seven apps and abandon them one at a time, starting with the ones nobody checks. The phone app keeps getting routine updates because app stores force the issue, while the desktop client and the browser extension quietly rot. 10 of the 28 providers I track have at least one platform more than six months behind their newest release: - TunnelBear updated something 3 days ago; their Firefox extension hasn't been touched in over three years. - TorGuard's iOS app got a release 7 months ago; their Windows client is from February 2024. Surfshark doesn't have one of those. Nothing is hiding. Two other reasons, which are my opinion rather than measurements: - Price. It's consistently one of the cheapest, especially on longer plans. Check current pricing yourself, it moves constantly. - WireGuard configs. You can pull one straight from the account panel. If you want to run it on a router, a NAS, or a box without their client, you're not fighting anyone to do it. The part you should be suspicious of Surfshark pays me. Let's be precise about how, because it changes what you should trust: It's affiliation, not sponsorship. They have no idea I'm writing this. Nobody reviewed it, nobody approved it, no money changed hands for it to exist. If someone buys through my link, I get a commission — that's the whole relationship. They can't buy placement because there's nothing to buy: the ranking is computed by code that cannot read the affiliate file. It's a separate file the scoring pipeline doesn't import. Partners and non-partners run through identical logic. I know that's exactly what someone with a payout would say. So don't take my word for it: - The formula is published: https://vpnupdates.app/methodology - The raw data is downloadable: https://vpnupdates.app/api/rankings.json - Every number links back to the app store or registry it came from — you can check any single one yourself. Surfshark being 1 while also being a partner is genuinely convenient for me, and I'd be annoyed at anyone who didn't raise an eyebrow at it. The answer is that you can recompute the whole thing. Three honest caveats 1. This measures maintenance, not quality. It says nothing about speed, server count, logging policy, jurisdiction, or whether a company deserves your trust. A VPN can ship every week and still be bad. Use this to rule providers out, then read an actual review. 2. Audits are a separate question from maintenance, and I keep them separate on purpose. For the record, Surfshark's are on their trust center and I've verified each one against a primary source: Cure53 on infrastructure and their Dausos protocol (2026), SecuRing on network infrastructure (December 2025) and on the apps and extensions (2025), and Deloitte no-logs assurance reports in both 2023 and 2025. The Deloitte reports are the one weak spot — they're readable inside a Surfshark account rather than published openly, which is worse than Mullvad or Proton, who just put theirs on the web. 3. The signal is asymmetric. Silence is strong evidence something's wrong. Frequent releases are much weaker evidence that something's right. Mullvad ships slowly and deliberately, it costs them points on my index, and they're still one of the most respected providers out there. If a ranking told you Mullvad was bad, the ranking would be broken. If you don't want to fund me, that's completely fine Genuinely. Pick from the top of the list and buy direct — Proton VPN and Mullvad are both excellent, both publish their audit reports openly rather than behind a login, and both are maintained across every platform. Nothing about the index changes based on who pays. If you'd rather support the project without a VPN in the mix, the Legend backer tiers do the same job more directly. And if Surfshark is what you were going to buy anyway, using the link costs you nothing and pays for the server bills, the data collection, and the time this stuff takes. More support means more of this gets built. That's the entire funding model — no sponsors, no paid placement, no one approving my copy. Links - My affiliate link: https://vpnupdates.app/go/surfshark - The index: https://vpnupdates.app/ - Why it exists: https://vpnupdates.app/why Ask me anything about the methodology. If you find a number that's wrong, tell me and I'll fix it — there's a verification job that re-checks every source weekly and files an issue when something drifts, but it's not perfect and I'd rather be corrected than confident.