ExpressVPN

ExpressVPN is registered in the British Virgin Islands, outside the five, nine, and fourteen Eyes intelligence alliances, and owned by Kape Technologies since a 2021 acquisition. On pure technical execution it sits near the top of this comparison.

TrustedServer infrastructure runs every server RAM only, meaning data cannot persist across a reboot, and PwC has separately audited the build process itself, not just the policy. Its Lightway protocol is open source and has been audited by Cure53 twice.

Security features

The kill switch is called Network Lock and is enabled by default on Windows, Mac, and Linux, blocking all traffic if the VPN connection drops. Split tunneling is available on Windows and Android, though not on macOS 11 and later or on iOS at all.

Lightway is ExpressVPN’s own protocol, written in Rust at around 2,000 lines of code, small enough to audit thoroughly, and it includes post quantum protection against future decryption attempts. A low latency Lightway Turbo variant is available on Windows, alongside standard OpenVPN and IKEv2 on Mac.

Encryption runs on AES-256 with a 4096-bit RSA key and SHA-512 HMAC authentication. Every server includes automatic traffic obfuscation and private DNS, with no IP, DNS, IPv6, or WebRTC leaks found across the app lineup.

Threat Manager and extra privacy tools

Threat Manager blocks tracking and malicious third party connections at the network level, alongside a built in ad blocker. IP Shuffle rotates the IP address assigned to your device across sessions and websites rather than keeping one static address for the whole connection.

Tor over VPN is supported through specific servers for anyone who wants Tor level anonymity layered on top of the VPN tunnel. Advanced and Pro plans add ExpressVPN Keys, a built in password manager, and Pro layers on an identity protection service with breach alerts.

The audit record

The most recent no logs assessment was conducted by KPMG, dated as of February 2025, concluding reasonable assurance that ExpressVPN does not log browsing history, traffic destination, data content, DNS queries, or connection metadata. Combined with the TrustedServer build audit, this is one of the more thoroughly verified infrastructure claims in the industry, not just a policy audit.

In 2017, Turkish authorities seized a physical ExpressVPN server during a criminal investigation and found no usable logs on it, a real world test of the no logs claim rather than a paper policy. The company also runs a public bug bounty program through Bugcrowd, paying out up to $100,000 for a verified critical vulnerability, and has accumulated 27 independent audits across Cure53, KPMG, PwC, F-Secure, and other firms.

Why this isn’t our top pick despite the numbers

In 2021, the US Department of Justice fined three former US intelligence and military personnel a combined $1.6 million over their role in Project Raven, a UAE state hacking operation that targeted journalists, activists, and human rights critics between 2016 and 2019. One of the three, Daniel Gericke, was ExpressVPN’s Chief Information Officer at the time and remained in the role afterward.

That is a serious mark against a company whose entire product is a promise of privacy, and it is why this cannot be rated a top recommendation regardless of how clean the technical audits are. Separately, a 2024 split tunneling bug briefly leaked DNS requests for roughly 1% of Windows users to their ISP before being patched, a real but comparatively minor issue on its own.

Using the apps

Apps are widely regarded as the most polished in this comparison, covering Windows 7 and later, macOS 10.11 and later with native Apple Silicon support, Linux with both a command line tool and a newer graphical interface, Android, and iOS. Android specifically adds screenshot blocking on top of the standard split tunneling controls.

Speed test results

Local servers show roughly a 1% speed reduction against a direct connection, while distant servers rarely drop beyond 40%. Gaming latency stayed minimal on nearby servers, with European routes measured under 85ms ping and one UK server test actually reducing ping from 32ms to 29ms through more efficient routing.

Streaming and platform support

MediaStreamer, a DNS based unblocking tool without encryption, extends streaming access to devices that cannot run the VPN app directly, including older smart TVs, Xbox, PlayStation, and Nintendo consoles. Native apps also cover Apple TV, Amazon Fire TV, Chromecast with Google TV, and pre installed 30 day trials on select TCL smart TVs.

Device compatibility and routers

Browser extensions are available for Chrome and Firefox, and the same extension works in Edge, Brave, and Vivaldi through the Chrome Web Store. Router support comes through a browser based setup app for Asus, Linksys, Netgear, and Microsoft routers.

ExpressVPN also sells its own WiFi 6 router, Aircove, with the app pre installed, plus a portable version called Aircove Go. Device limits scale by plan: 10 simultaneous connections on Basic, 12 on Advanced, and 14 on Pro.

Restrictive networks and China

Connecting from China is possible but not guaranteed. It requires specific servers and a mirror URL to download the app in the first place, since the standard website is typically blocked there. The 30 day money back guarantee gives room to test this specifically before committing.

Torrenting and P2P

P2P traffic is allowed across the server network with no separate opt in required. Port forwarding is only available at the router level rather than through the app directly, and there is no SOCKS5 proxy option, both areas where Proton VPN currently offers more direct control.

Customer support

Live chat runs 24 hours a day with responses typically arriving in under a minute. Email support is also available for anything that needs more detail than a chat window allows.

Pricing and plans

ExpressVPN sells three tiers: Basic, Advanced, and Pro, each available on monthly, one year, or two year terms. All prices below are current as of August 2026 and billed in USD.

Prices per month, in USD, at each billing term. Source: ExpressVPN pricing, verified August 2026.

Basic covers the VPN itself with standard encryption, the kill switch, and split tunneling. Advanced adds the ExpressVPN Keys password manager and a discount on the Aircove router, and Pro layers on an identity protection service on top of everything in Advanced.

Checkout accepts Visa, Mastercard, PayPal, Bitcoin, Apple Pay, and Google Pay. There is no dedicated business or teams plan, unlike Proton and NordVPN. Consumer tiers scale up to 14 simultaneous devices on Pro instead of a separate business product.

Every tier carries a 30 day money back guarantee for first time customers, and there is no permanent free plan.

Company background

ExpressVPN was founded in 2009 and is registered in the British Virgin Islands, a jurisdiction outside the major intelligence sharing alliances. In September 2021, it was acquired by Kape Technologies, a company that also owns Private Internet Access and CyberGhost.

Kape Technologies was previously known as Crossrider, a company with a documented history of distributing adware and browser hijacking software before pivoting to the VPN and cybersecurity market. That history predates the current ExpressVPN acquisition specifically but is worth knowing as context for who owns the company today.

Who it’s for

How it compares

Against Proton VPN, ExpressVPN’s technical execution and audit trail hold up well, but Proton’s lower price, real free tier, and cleaner ownership history keep it ahead in our scoring. Neither company’s jurisdiction is inside a major intelligence alliance.

Against NordVPN, the two sit close on paper technically, though NordVPN measures faster and costs less at the two year rate, and carries no equivalent to the Project Raven history. ExpressVPN’s RAM only TrustedServer infrastructure remains a genuine strength either way.

Against Mullvad, ExpressVPN trades Mullvad’s anonymous, no email signup model for far more polished apps and broader device support, at a noticeably higher price.

Surfshark undercuts ExpressVPN on price by a wide margin and allows unlimited simultaneous devices instead of a tiered cap topping out at 14, with a Netherlands jurisdiction that carries its own tradeoffs inside the nine Eyes alliance.

Private Internet Access is cheaper than every ExpressVPN tier and shares a parent company, Kape Technologies, with it. PIA’s no logs claim has been tested in real subpoenas, a similar real world proof point to ExpressVPN’s own 2017 Turkish server seizure.

The verdict

Worth it, not our top recommendation. The apps, infrastructure, and audit trail are genuinely excellent, and if that is all you are weighing, ExpressVPN holds up on its own terms. The Project Raven history is a legitimate factor for a privacy product specifically, and this review is not willing to rate around it.