My router's client list shows one VPN connection under the house profile — and forty-some devices route through it without any of them showing up as a separate slot. That number trips people up. Most multi-device VPN comparison guides for a family start with a device count: two laptops, three phones, a couple of tablets, a smart TV, add the kids' stuff and you're past ten before lunch. Then you go looking for a plan with enough simultaneous connections to cover the tally. It's the wrong math for home networking and family security both; a router-level setup sidesteps the slot-counting exercise entirely, because the VPN client authenticates once, on the router, and everything behind it rides that single tunnel without ever touching your account's connection limit.
I didn't start there. Early on, I figured enabling DNS-over-HTTPS in Firefox on every laptop in the house counted as covering my privacy bases — one browser setting, done, nothing else to think about. It doesn't work that way. DoH encrypts the DNS lookup between the browser and its resolver; it does nothing for the smart TV, the game console, a partner's work laptop running its own network stack, or any traffic that isn't a browser request to begin with. The gap between "I secured my browser" and "I secured the household" is the gap this whole piece is about.
Why Device-Counting Breaks Multi-Device Protection
Most major providers cap simultaneous connections somewhere between five and ten devices per account, and buying guides treat that number like the whole decision. It isn't. A VPN router setup usually counts as a single connection from the provider's side, even though it's protecting every device that touches that router — laptops, phones, the kids' iPads, the smart fridge nobody remembers is even on the network. Set it up that way and the five-or-ten cap stops mattering, because you're never running more than one VPN client at the router level in the first place.
I still run protocol comparisons for my own curiosity — WireGuard-based options like NordLynx behave differently than something like ExpressVPN's Lightway on the same line, and the gap shows up more on a single device pushing a big transfer than on a router juggling ordinary household traffic. That's the part people miss: the bottleneck in a family setup usually isn't raw throughput. It's whether everyone stays connected without you managing it device by device.
ExpressVPN is the clearest example of that trade-off. Its per-device connection limit is tighter than some competitors, and in my testing that tighter cap seems to correlate with steadier per-device bandwidth — nobody's stream stutters because six other things are pulling on the same tunnel. That's a real advantage if you're optimizing for one heavy user on one device. It stops being an advantage the moment your partner has to text you to free up a slot before she can watch anything, which is exactly the friction a family VPN is supposed to remove.
Does an Unlimited-Connection Plan Solve It, or Just Hide the Symptom?
Switching the house to Surfshark made the slot-counting problem disappear because there's no slot left to count — connections are unlimited on one account. That's a genuine fix for the specific symptom: partner annoyed, TV kicked off, five-device cap hit mid-movie. It's worth being honest about what it fixes and what it doesn't, though. Unlimited connections remove the friction of managing devices. They don't, by themselves, replace understanding what's actually protected. CleanWeb, Surfshark's DNS-level ad and tracker blocking, is the part that actually changed how the house felt day to day — pages loaded lighter, nobody touched a setting, and the improvement was subtle enough that nobody asked what changed.
My testing setup lives on a standing desk in the Beacon Hill office that's been locked at sitting height since I stopped pretending I'd use it any other way — three monitors, a couple of small machines quietly logging speed results around the clock, and a whiteboard by the router shelf that's mostly crossed-out config notes at this point. There's a coffee mug parked next to the patch panel that never quite gets finished before it goes cold. Ezra, a former teammate now working in SoMa, called mid-benchmark one evening just to argue that my methodology was flawed — a conversation we've had before and will probably have again.
The best evidence for the router-level approach didn't come from a chart, though. It came from opening a terminal at a coffee shop, SSHing into the home server the way I would from my own desk, and getting back a connection with no detectable lag — same as sitting three feet from the rack. That's the test that actually matters for a family setup: not whether the VPN can move one big file fast, but whether it disappears completely into normal, boring use.
Surfshark runs AES-256 encryption, the same standard most of the major providers ship with at this point, so encryption strength alone isn't much of a differentiator in a family-VPN decision anymore — nearly everyone worth shortlisting cleared that bar years ago. Where the real differences show up is protocol choice and how a provider's defaults behave under real household load, which is exactly what I track in 30 days of VPN speed tests — worth a look if you want actual numbers instead of taking my word for which protocol felt faster on a given night.
Two Alternatives Worth Knowing, Depending on What You're Optimizing For
Private Internet Access is the pick for a household with someone who wants to see under the hood — open-source apps across every platform, a large server list, and configuration options most family members will never touch but a power user appreciates having. Waverly Obasi, who I know from a subreddit where I occasionally end up moderating methodology arguments, runs a similar setup on her own gigabit line in Chicago and made the same call for the same reason: she won't run a client she can't read the source of, full stop. I don't hold that line quite as hard myself, but I get it.
CyberGhost VPN sits at the other end of that spectrum — a genuinely cheap long-term plan, a 45-day refund window that's longer than what most competitors offer, and streaming-labeled servers that made a slow week of catching up on shows noticeably less laggy than I expected from a budget option. It's a reasonable place to start if a household isn't sure it wants to commit to running a VPN full-time yet, since the refund window gives you room to back out without an argument about sunk cost.
Judge a Family VPN by What It Removes, Not What It Adds
None of this is really about finding the fastest single result on a benchmark chart. It's about picking something the rest of the household eventually stops noticing. Whether that ends up being the unlimited-connection convenience of Surfshark or the audited, no-logs infrastructure behind NordVPN, the deciding factor is whether it survives contact with people who never signed up to think about network security. My partner stopped commenting on "the flags I've planted in the network" a while back — not because I explained anything better, but because the setup finally got out of her way.
If your house is stuck playing device musical chairs every time someone wants to stream something, that's the actual signal to fix — not the encryption specs, not the server count. Start with Surfshark if unlimited connections are the piece you're missing; the rest of the household will likely never know it's running, which, for a family VPN, is the whole point.