Dausos is Surfshark’s proprietary VPN protocol, built from scratch specifically for individual users. Launched in April 2026, it is currently available exclusively on the macOS App Store application.
By offering a dedicated private data tunnel, utilizing the advanced AEGIS-256X2 encryption algorithm, and natively incorporating post-quantum cryptography, the Dausos protocol sets a new standard for everyday users.
This guide breaks down exactly how the architecture works, how it compares to WireGuard, and whether you should make the switch.
Key takeaways:
- Dausos is Surfshark’s proprietary VPN protocol. It gives each user a separate, dedicated data tunnel instead of sharing a single tunnel with other users on the same server.
- It utilizes AEGIS-256X2 encryption, an algorithm Surfshark states no other commercial VPN currently implements.
- Surfshark claims potential speed improvements up to 30% over standard protocols, though independent testing shows real-world results vary depending on download or upload metrics.
- The independent cybersecurity firm Cure53 audited the protocol in early 2026 and found no Critical or High severity vulnerabilities.
- The software is currently in its early rollout phase, meaning users may experience occasional connectivity drops.
- Surfshark plans to support additional platforms beyond macOS in the future, but the development team has officially confirmed there is no exact release timeline yet.
1. What is Dausos protocol?
Dausos is a proprietary VPN protocol developed by Surfshark. It is the first VPN protocol the company has built entirely from scratch instead of modifying existing networking technology. The name comes from a Lithuanian word meaning “heaven”, which references Surfshark’s Lithuanian roots and Baltic mythology to symbolize an elevated internet experience.
Surfshark built this new technology because existing options like WireGuard, OpenVPN, and IKEv2 were originally designed for enterprise networking environments. Developers later adapted those enterprise tools for consumer VPN applications. Dausos was designed with individual users as the primary audience from the very beginning.
By focusing entirely on the consumer VPN experience, the developer aimed to eliminate the resource waste commonly found in adapted protocols.
2. How the Dausos protocol works
Traditional VPN protocols route all users connected to a specific server through a single shared tunnel interface. Dausos changes this fundamental architecture by assigning every single user their own completely dedicated tunnel. The system operates through four primary technical mechanisms.
2.1. Dedicated tunnels for every user
On a traditional shared tunnel, one user’s heavy traffic load can slow down packet processing for everyone else connected to that server. A dedicated tunnel directly solves this problem. Each user’s active session receives its own isolated network interface on the server side.
Karolis Kaciulis, a lead systems engineer at Surfshark, notes that server busyness is a major factor in performance drops. When users share a tunnel, handling one person’s packets can easily bottleneck another person’s data flow.
Dausos eliminates this shared interference. Every time a user connects, the server creates a new network interface exclusively for that specific VPN session. This server-side isolation also provides a distinct security benefit.
The risk of cross-traffic exposure is already very low in modern consumer VPNs. This dedicated architecture reduces that risk even further because active sessions do not share any network space or processing resources.
2.2. AEGIS-256X2 encryption
AEGIS-256X2 is an advanced authenticated encryption algorithm. It processes the encryption payload and authenticates the data simultaneously. This dual-action processing is noticeably faster on modern hardware compared to the standard AES-GCM approach used by most VPN protocols today.
As of the official launch, Surfshark states that no other commercial VPN utilizes AEGIS-256X2. Dausos is the first to implement it. For the user, this translates to faster encryption processing with significantly less system overhead.
This processing efficiency directly contributes to the potential speed improvements Surfshark advertises, though real-world results will vary based on your network. Additionally, AEGIS-256X2 is designed to remain secure against advanced computational threats. It pairs directly with the underlying post-quantum infrastructure to ensure long-term data protection.
2.3. Post-quantum and post-compromise security
Dausos utilizes a hybrid key exchange mechanism to achieve post-quantum cryptography. It combines the established X25519 modern standard with ML-KEM, which is a NIST-approved quantum-safe algorithm. Surfshark’s technical documentation labels this combined scheme as X25519MLKEM768.
The protocol also uses the ML-DSA signature scheme for its built-in root certificate authority. This structure ensures your encrypted traffic is protected against future attacks from quantum computers.
Post-compromise security operates as a secondary protective layer above standard perfect forward secrecy. With perfect forward secrecy, new encryption keys are generated each session, but they are often derived from previous keys. If a key is compromised, an attacker might theoretically derive future keys.
With the post-compromise security in Dausos, every new set of encryption keys is generated entirely independently. These keys have no mathematical relationship to any previous session key. A compromised key cannot be used to decrypt future data. The protocol also randomizes server ports for each session to add an extra layer of unpredictability.
2.4. Adaptive performance engine
Dausos includes a built-in performance engine that actively monitors your connection. It adjusts to network conditions, bandwidth availability, and device capabilities in real time.
The protocol behaves differently on a highly stable fiber connection than it does on a mobile network transitioning between Wi-Fi and cellular data. While the dedicated tunnel isolates the user from others, the adaptive engine optimizes how that tunnel operates based on your exact environment.
3. Dausos protocol vs WireGuard: How do they compare?
WireGuard is the default protocol on most Surfshark platforms. It serves as the most relevant point of comparison for macOS users who are considering trying the new architecture. Review the technical differences in the table below.
| Feature | Dausos | WireGuard (Surfshark) |
| Developer | Surfshark (proprietary) | Open source community |
| Availability (Surfshark app) | macOS App Store only | macOS, Android, Linux |
| Encryption | AEGIS-256X2 | ChaCha20 |
| Post-quantum (in-app) | Yes (macOS) | Yes (macOS, Android, Linux) |
| Post-quantum (manual config) | N/A | No |
| Post-compromise security | Yes | No |
| Per-user dedicated tunnel | Yes | No |
| Port randomization | Yes | No |
| Independent audit | Cure53 (Feb-Mar 2026) | Yes (Cure53 / Deloitte) |
| Open source | No | Yes |
| Surfshark internal avg. download | 318 Mbps | 244 Mbps |
| ZDNET independent download drop | 38.25% | 35.54% |
Note on speed data conflict:
When evaluating performance, be aware of differing speed test results. Surfshark’s internal data shows Dausos averaging 318 Mbps in download speeds, comfortably beating WireGuard’s 244 Mbps. However, an independent ZDNET test from April 2026 paints a more nuanced picture.
In that specific test environment, WireGuard preserved slightly more of the baseline download speed, dropping 35.54% compared to the 38.25% drop seen with Dausos. On the other hand, Dausos proved better for uploads, losing only 4.88% of the baseline speed versus WireGuard’s 6.30% loss. Because performance heavily depends on your local network, device hardware, and chosen server, you should test both protocols to see which handles your daily workload best.
The platform’s availability highlights a strict limitation. WireGuard works natively on macOS, Android, and Linux. It also supports manual configuration on iOS and Windows. Dausos is strictly limited to the macOS App Store application.
Both protocols feature post-quantum protection on macOS. However, WireGuard’s post-quantum protection does not apply if you configure it manually outside the app. Dausos includes post-compromise security and port randomization by default.
WireGuard is open source with roughly 4,000 lines of code, allowing public auditing. Dausos is currently a proprietary, closed-source system. While Surfshark has hinted at potentially open-sourcing parts of the protocol in the future, users should treat it as entirely closed-source for now.
4. Dausos vs NordLynx, Lightway, and NordWhisper
The VPN industry is increasingly shifting away from generic legacy tunnels toward optimized, in-house protocols. While Dausos is Surfshark’s first completely custom design, competitors like NordVPN and ExpressVPN already offer their own unique architectures. Understanding how Dausos compares to NordLynx, Lightway, and NordWhisper helps clarify its specific advantages.
- NordLynx: Acts as the everyday default option for achieving maximum download speeds on regular, unrestricted networks. It builds upon the WireGuard framework and uses a custom double NAT system to prevent IP address logging, but it still relies on a shared-tunnel architecture.
- NordWhisper: Serves as a specialist fallback tool for beating VPN blocks in highly restricted environments. It uses web-tunnel technology to disguise VPN traffic as standard HTTPS web browsing, prioritizing access and obfuscation over pure speed.
- Lightway: Focuses heavily on open-source public transparency and providing ultra-reliable connection roaming for mobile devices. It keeps the tunnel alive seamlessly when transitioning between Wi-Fi and cellular networks, minimizing battery drain.
- Dausos: Differentiates itself by emphasizing strict per-user tunnel isolation and built-in post-quantum cryptographic protection. This dedicated structure lowers the theoretical risk of user-to-user exposure on busy servers, standing in contrast to traditional shared tunnels.
5. What are the key capabilities of the Dausos protocol?
Dausos introduces several advanced features that are not commonly found together in standard consumer VPN protocols. Rather than relying on generic legacy frameworks, it combines modern cryptography with an individualized routing structure to deliver a highly secure and stable experience. Here is a quick summary of the core technical capabilities that define the protocol.
- Dedicated user tunnels: Every connection utilizes its own entirely private network tunnel to prevent bandwidth bottlenecking and cross-traffic interference on the server side.
- AEGIS-256X2 encryption: A modern, high-performance algorithm providing quantum-resistant security without sacrificing daily browsing speeds.
- Post-quantum security: The architecture is natively designed to withstand decryption attempts from future quantum computing threats.
- Adaptive performance: A built-in engine actively adjusts to your specific local network quality and device hardware to maintain connection stability.
- Independent security audit: The underlying architecture was thoroughly tested and verified by the respected cybersecurity firm Cure53.
6. Pros and cons of the Dausos protocol
Before making the switch from established options like WireGuard or OpenVPN, it is important to weigh the practical benefits against the current limitations of this new technology. Because the protocol is still in its early rollout phase, it presents a mix of high-end security features and strict platform restrictions.
Pros
Strict user isolation: The dedicated per-user tunnels prevent bandwidth bottlenecking caused by other heavy users sharing the same server space.
Future-proof security: Built-in post-quantum cryptography and post-compromise security ensure your encrypted data remains safe from both current and advanced future computational threats.
Optimized encryption speed: The AEGIS-256X2 algorithm processes data simultaneously, providing highly efficient encryption with minimal hardware strain.
Strong upload retention: Independent testing indicates the protocol handles upload-heavy tasks exceptionally well compared to standard alternatives.
Cons
Strictly limited availability: You can only use it on the macOS App Store application, leaving Windows, Android, Linux, and iOS users completely unsupported for now.
Closed-source code: Unlike WireGuard, the underlying architecture is proprietary and not available for public review by independent researchers.
Mixed download speeds: While upload speeds are strong, independent tests show it may drop slightly more baseline download speed than WireGuard on certain networks.
7. Is Dausos protocol safe? The Cure53 audit explained
Cure53 is a highly respected, Berlin-based independent cybersecurity firm. The organization conducted a thorough penetration test and source code audit of Dausos between February and March 2026. The audit focused strictly on the protocol’s connection architecture and internal cryptography.
The audit identified eight findings rated at medium severity or lower within the specified scope. The testers found absolutely no Critical or High severity vulnerabilities within the actual Dausos architecture. The official Cure53 summary describes the platform as stable and resilient.
Surfshark remediated the majority of these minor findings immediately following the testing phase. You can review the full Cure53 audit summary PDF directly at surfshark.com/media/NOR-29-summary.pdf. Surfshark has officially filed a patent to protect the protocol architecture, highlighting the company’s long-term commitment to securing this proprietary technology.
8. Dausos protocol availability: Which devices support it?
As of the date of publication, Dausos is exclusively available on the Surfshark macOS app downloaded from the Apple App Store.
Warning: If you downloaded the Surfshark application directly from surfshark.com using the .dmg file, Dausos will not appear in your protocol list. You must uninstall the DMG version first to avoid application conflicts. Once uninstalled, download the official App Store version.
The protocol is not yet available on Android, iOS, Windows, or Linux. Surfshark has stated that support for additional platforms is actively planned. However, the company has officially confirmed there is no exact timeline for these releases just yet. We recommend that Android and Linux users continue using WireGuard to utilize its built-in post-quantum protection on those platforms.
| Platform | Dausos available? |
| macOS (App Store) | Yes |
| macOS (.dmg from website) | No |
| iOS | No |
| Android | No |
| Windows | No |
| Linux | No |
9. How to enable the Dausos protocol on macOS
Follow these six exact steps to activate the new protocol on your Apple computer:
- Open the Surfshark app on your Mac. Confirm it is the App Store version and not the .dmg version. If you are unsure, check your Launchpad. App Store downloads appear under the standard macOS app folder.
- Navigate to the left sidebar and click on Settings.
- Select VPN Settings from the main Settings menu.
- Click on Protocol to expand the full list of connection options.
- Choose Dausos from the dropdown list.
- Connect to any available Surfshark server. The new protocol works universally with all server locations. You can also select the Automatic setting to let the app choose the best protocol based on your current network health.
Troubleshooting: If the connection fails or becomes unstable while Dausos is selected, immediately switch to WireGuard or OpenVPN and attempt to reconnect. Restart the Surfshark application if the interface freezes. Please submit your diagnostic logs via the app settings to help the development team improve the software.
10. How Dausos fits into Surfshark’s full protocol lineup
Surfshark currently supports four distinct connection protocols. Dausos is the newest addition, but the other three serve specific technical needs. Review the options below to understand when to use each one.
10.1. WireGuard
WireGuard operates on approximately 4,000 lines of code. This minimal structure makes it incredibly lean and easier for security researchers to audit. It serves as the default automatic selection on most Surfshark platforms.
Post-quantum protection is natively built into WireGuard on macOS, Android, and Linux, though it does not apply to manual setups. It remains the best overall choice for Android, Linux, and Windows users who need an optimal balance of speed and security.
10.2. IKEv2
IKEv2 stands for Internet Key Exchange version 2. It is a highly stable protocol perfectly suited for mobile users because it handles the transition between Wi-Fi and cellular data without dropping the connection.
Surfshark recently removed IKEv2 as a selectable option in its Windows app, though Windows users can still configure it manually. It remains fully available within the iOS and macOS applications.
10.3. OpenVPN
OpenVPN is a long-established standard recognized for its broad hardware compatibility. It is commonly used for direct home router configurations. It is the bulkiest of the four protocols regarding processing overhead, which typically makes it slower than WireGuard, IKEv2, and Dausos.
It is the optimal choice for users who want to configure Surfshark securely on a router. You can access the necessary OpenVPN config files directly by logging into your account at my.surfshark.com and navigating to the Manual Setup tab.
11. Should you switch to Dausos?
Deciding whether to switch depends entirely on your hardware and your tolerance for newer software. Evaluate your setup using the guidelines below.
Switch to Dausos if you meet these conditions:
- You use macOS and have the official App Store version of the Surfshark app installed.
- You are comfortable testing new software and reporting occasional bugs.
- You want to utilize the new AEGIS-256X2 encryption and post-compromise security mechanisms.
Stick with WireGuard or another protocol if you match these conditions:
- You operate on Android, iOS, Windows, or Linux devices where Dausos is completely unavailable.
- You prioritize maximum download speed reliability over newer features.
- You strictly prefer using open-source, publicly auditable code.
12. FAQs about Dausos protocol
What is the new protocol for Surfshark?
Surfshark’s new protocol is called Dausos. The company launched it in April 2026. It is a proprietary protocol built from scratch for individual consumer VPN users. It provides dedicated tunnels and is currently available on the macOS App Store application.
What encryption does Dausos use?
The protocol utilizes AEGIS-256X2 encryption. This is a highly efficient, modern authenticated encryption algorithm. Surfshark states it is the first commercial VPN to implement this standard. It also utilizes a hybrid post-quantum key exchange combining X25519 with ML-KEM.
Is Dausos protocol available on Android
As of publication, Dausos is not available on Android. It is strictly limited to the macOS App Store application. Surfshark developers have confirmed they plan to expand to other platforms, but there is no exact timeline for an Android release yet. Android users should continue using WireGuard for optimal security.
Does Dausos work on iOS?
Dausos is not currently available on iOS devices. Mobile iOS users should rely on WireGuard or IKEv2 within the Surfshark app until the new architecture is officially ported to Apple’s mobile operating system.
Is Dausos faster than WireGuard?
The answer depends on which test data you review. Surfshark’s internal testing shows Dausos averaging 318 Mbps compared to WireGuard’s 244 Mbps. An independent ZDNET test from April 2026 found that WireGuard retained more download speed, while Dausos retained more upload speed. Speeds always vary by network condition and hardware.
13. Conclusion
The Dausos protocol is Surfshark’s first proprietary architecture built specifically for everyday consumers rather than enterprise networks. It brings three distinct innovations to the platform. Users gain dedicated per-user tunnels, modern AEGIS-256X2 encryption, and rigorous post-quantum protection combined with post-compromise security.
Despite the strong technical foundation, it is strictly limited to the macOS App Store application, and the speed performance data currently presents mixed results compared to WireGuard. If you are an existing macOS user with the App Store version installed, it is highly recommended that you test the connection to see how it performs on your local network.
If you want to learn more ways to optimize your connection, check out our step-by-step VPN Guides, or head back to the Safelyo homepage for more simple privacy tips.
