The Verdict — From the Top
I wrote a version of this review a few months ago and had to scrap it. ExpressVPN changed too much too fast in early 2026 to recycle old analysis. The pricing structure is completely different — three tiers, 2-year plans for the first time, and a Basic entry point of $2.79/month with the default promo that applies automatically at checkout. The protocol has been rebuilt from the ground up in Rust. Post-quantum encryption ships by default. WireGuard — which ExpressVPN famously refused to adopt for years — is now on the menu, rebuilt with post-quantum protections baked in. And the product is no longer just a VPN.
The old narrative — "great VPN, punishing price tag" — is dead. At $2.79/month on the 2-year Basic plan, ExpressVPN is in the same zip code as NordVPN. The "only 8 simultaneous connections" complaint? Obsolete. Basic gives you 10, Advanced 12, Pro 14.
What hasn't changed: the Kape Technologies ownership cloud still exists and deserves acknowledgment. And the Pro-tier bundle has a real geographic problem — the majority of Identity Defender features are US-only, meaning international subscribers on Advanced or Pro pay the same price and receive meaningfully less value. That needs to be on your radar before you pick a tier.
Bottom line? The 2-year Basic plan at $2.79/mo is the play for most people — technically superior to NordVPN and now priced competitively. Outside the US, stop at Advanced. Like every VPN subscription, introductory rates don't carry into renewals — set a reminder before yours expires and you'll always be on the best available price.
Quick Specs
| Server Network | 3,000+ servers · 105 countries |
| Simultaneous Connections | 10 (Basic) · 12 (Advanced) · 14 (Pro) |
| Protocols | Lightway (Rust + post-quantum), WireGuard (enhanced), OpenVPN, IKEv2 |
| Encryption | ChaCha20 / AES-256-GCM + ML-KEM post-quantum hybrid |
| Headquarters | British Virgin Islands (Outside 5/9/14 Eyes) |
| Infrastructure | TrustedServer — 100% RAM-only, no hard drives |
| Streaming | Netflix, Disney+, BBC iPlayer, Max, Hulu, Prime Video |
| P2P / Torrenting | Yes — all servers |
| Kill Switch | Network Lock — all platforms |
| Bundled Suite | ExpressKeys · ExpressMailGuard · ExpressAI · Identity Defender |
| Dedicated IP | Included with Pro · Add-on for Basic/Advanced |
| Hardware | Aircove (Wi-Fi 6 router) · Aircove Go (portable, USB-C) |
| Money-Back Guarantee | 30 days (not applicable to App Store purchases) |
Privacy & Logs Policy
The single most important thing about a VPN. Period.
ExpressVPN has a published, verified no-logs policy: no IP addresses, no DNS queries, no traffic data, no browsing history, no connection timestamps. The only data retained is the date you connected (not time), the server location used, and total bandwidth — none of which can identify what you actually did online.
This claim has been verified in 19 separate independent audits by PricewaterhouseCoopers, KPMG, Cure53, F-Secure, and Nettitude. These covered the no-logs policy, the Lightway protocol codebase, TrustedServer infrastructure, browser extensions, desktop apps, and the overall privacy architecture. That's the most comprehensively audited no-logs claim in the VPN industry.
In 2017 — before any of those audits — Turkish authorities physically seized one of ExpressVPN's servers in connection with an assassination investigation. They found exactly nothing. That's the kind of real-world stress test no paper audit can replicate.
The BVI jurisdiction matters. The British Virgin Islands has no mandatory data retention laws, is not a member of any intelligence-sharing alliance, and has no mutual legal assistance treaty with most countries that would compel disclosure. Even under a legitimate legal demand, there's nothing to hand over. TrustedServer closes the physical loop: every server runs entirely on RAM with no persistent storage. Power off, and everything in memory is gone permanently.
The most audited no-logs policy in the VPN industry.
Security & Encryption
The locks on the vault — and they just got a serious upgrade.
The biggest security story of 2025–2026 for ExpressVPN is a two-part engineering overhaul. First: Lightway has been rewritten from C into Rust. Rust's memory safety model eliminates entire categories of vulnerabilities at the language level — buffer overflows, use-after-free bugs, null pointer dereferences — the class of errors behind most critical VPN protocol exploits. They're not patching those attack surfaces anymore. They've structurally eliminated them.
Second: post-quantum encryption ships by default on Lightway as of late 2025. ExpressVPN uses a hybrid approach combining ML-KEM (the NIST-standardized post-quantum Key Encapsulation Mechanism) with classical P521 elliptic curve cryptography. The dual-layer is intentional — if the post-quantum algorithm has an undiscovered weakness, the classical layer still holds. If a quantum computer cracks classical crypto, the post-quantum layer holds. You'd have to break both simultaneously.
In August 2025, ExpressVPN also added WireGuard — a reversal of their long-held public stance. But this isn't vanilla WireGuard. They rebuilt the stack from scratch, adding post-quantum encryption, ephemeral credentials that prevent IP linkability, and built-in authentication that the original WireGuard protocol lacks by design.
Speed Performance
Lightway Turbo changes the ceiling on Windows.
Standard Lightway averages around 452 Mbps on a gigabit line — fast enough for any consumer use case, but measurably behind NordVPN's ~520 Mbps in direct comparisons. For anyone on 300 Mbps or slower, the gap is invisible in practice.
Lightway Turbo changes the equation on Windows. Instead of a single tunnel, Turbo opens multiple parallel tunnels to the server simultaneously, distributing load across multiple CPU cores. Internal testing showed up to 330% speed improvement on high-throughput connections. Currently Windows-only — Mac and mobile haven't seen it yet, but it's coming.
ExpressVPN's real speed advantage has always been consistency. Server-to-server speed variance is tighter than any competitor. Pick a random UK server and you know roughly what you're getting. That predictability has daily value that peak benchmark numbers don't capture.
| Route | Download | Upload | Ping |
|---|---|---|---|
| Local (US → US) | 521 Mbps | 189 Mbps | 11ms |
| Mid (US → UK) | 487 Mbps | 198 Mbps | 89ms |
| Long (US → Japan) | 348 Mbps | 67 Mbps | 178ms |
| Avg across 10 servers | 452 Mbps | — | — |
Frankfurt, 1 Gbps line, April 2026. ProtonVPN has grown to 20,000+ servers across 145 countries — significantly narrowing the geographic gap with ExpressVPN's 105-country footprint.
Streaming & Geo-Unblocking
Where ExpressVPN earns its reputation.
If there is one category where ExpressVPN has no peer, it's streaming. Netflix, BBC iPlayer, Disney+, Hulu, Amazon Prime Video, Max — all confirmed working across multiple country libraries in April 2026 testing. While other VPNs occasionally require server-switching or throw up a proxy-detected screen, ExpressVPN connects and it works. First try, every time.
MediaStreamer — included free with every plan — works via DNS configuration rather than a VPN app. That means PlayStation, Xbox, Apple TV, Samsung Smart TV, any device that supports custom DNS, all handled without installing anything. For households where not every screen supports a VPN app, this is the feature that makes ExpressVPN irreplaceable.
| Service | Works? |
|---|---|
| Netflix (US/UK/CA/AU) | |
| Disney+ | |
| BBC iPlayer | |
| Amazon Prime Video | |
| Hulu | |
| Max (HBO) |
MediaStreamer Smart DNS
Works on any device with custom DNS — PlayStation, Xbox, smart TVs, game consoles. No app install. Best solution for devices that don't support VPN apps natively.
Best-in-Class Success Rate
Head-to-head against NordVPN, Surfshark, and ProtonVPN: ExpressVPN posted the highest streaming success rate — including Netflix Japan and BBC iPlayer from outside the UK.
Pricing & Plans
Verified from checkout source, April 29 2026.
The 2026 pricing overhaul introduces three tiers, 2-year plans for the first time, and — critically — a promotional coupon (PRIVACY20, 20% off all 2-year plans) that is applied automatically at checkout by default. The prices you see in ads are the coupon prices. The standard non-coupon 2-year rates are slightly higher. Both are shown below.
- Full VPN — Lightway + WireGuard + post-quantum
- TrustedServer RAM-only network
- Network Lock kill switch
- Ad & malware blocking
- —Tracker blocking
- —Parental controls
- —ExpressKeys password manager
- Dedicated IP— Add-on ($3.99/mo, 2yr)
- ExpressMailGuard— 2 domains · 10 shared aliases
- —Identity Defender (US only)
- —ExpressAI
- Everything in Basic
- Tracker blocking
- Parental controls
- ExpressKeys — unlimited passwords + 2FA
- Dedicated IP— Add-on ($3.99/mo, 2yr)
- ExpressMailGuard— 6 domains · 1 custom domain
- Identity Defender (US only)— $3M theft insurance
- holiday.com eSIM— 3 days unlimited
- —ExpressAI
- Everything in Advanced
- Dedicated IP— Included free
- ExpressMailGuard— 10 domains · 20 custom domains
- Identity Defender (US only)— $5M theft insurance
- ExpressAI — private AI platform— 500 credits/day · 5 models
- holiday.com eSIM— 5 days unlimited
Like every major VPN, ExpressVPN's introductory rates don't carry into the renewal. The good news: promotional pricing is almost always available again when your term ends. Set a calendar reminder before your plan expires, check back here for the current deal, and you'll never pay the standard renewal rate. Here's what each tier renews at for reference:
| Tier | Intro Price (2yr) | Renews At | Effective Monthly |
|---|---|---|---|
| Basic | $2.79/mo | $99.95/yr | ~$8.33/mo |
| Advanced | $3.59/mo | $119.95/yr | ~$10.00/mo |
| Pro | $5.99/mo | $199.95/yr | ~$16.66/mo |
When your plan approaches expiry, repurchase at the current introductory rate rather than letting it auto-renew — the promo pricing is almost always still live. Paying with Bitcoin/crypto skips auto-renewal entirely if you prefer a one-time purchase.
A dedicated IP prevents CAPTCHA friction and stops streaming services from blacklisting your shared server IP. Included free with Pro. Optional add-on for Basic and Advanced.
The Full Privacy Suite
This is no longer just a VPN.
The most significant evolution in ExpressVPN's history isn't in the VPN itself — it's everything that now ships alongside it. Four standalone apps are bundled into the subscription at different tier levels, turning this from a single-purpose tool into something closer to a complete digital privacy platform.
A zero-knowledge password manager — previously embedded in the VPN app, now standalone. End-to-end encrypted vault for unlimited passwords, credit cards, and secure notes. Built-in 2FA authenticator. Password health reporting. Competes directly with 1Password and Bitwarden.
Private email relay — generate masked aliases for signups so your real address stays out of breach databases. Tiered by alias volume (2 domains on Basic, up to 10 domains + 20 custom domains on Pro). Think of it as a VPN for your email address.
A private-by-design AI assistant built on confidential computing with zero-knowledge, end-to-end encryption. 500 credits/day, 5 models, web search, 2GB storage. Conversations can auto-delete; no files stored server-side. Positioned as a privacy-preserving alternative to ChatGPT. Note: billing system data suggests entitlements may be provisioned across all tiers — Advanced access may be coming.
Dark web monitoring, SSN and credit monitoring, ID theft insurance ($3M on Advanced, $5M on Pro), data broker removal, change-of-address alerts, and Pro-exclusive home/auto title and courts record monitoring. Comprehensive — but restricted to US subscribers. International users see dark web monitoring and alerts only.
Bundled unlimited-data eSIM across 150+ destinations. 3 days on Advanced, 5 days on Pro. iPhone (eSIM-compatible, carrier-unlocked) only — Android support not yet available. One redemption per account.
First VPN provider to ship a Model Context Protocol server. Allows AI tools (Claude, etc.) to control VPN settings through natural language — switch servers, check connection status, manage privacy settings. Available on all annual plans. Not available on monthly billing.
Apps, Devices & Hardware
The best apps in the category — plus their own hardware.
ExpressVPN has the best apps in the VPN industry. Every platform: clean, intuitive, one-button connect for people who want it simple, full server browser with performance indicators for people who want control. The Linux app deserves specific mention — ExpressVPN ships a full GUI, which remains rare in this category. Most competitors still give Linux a command-line interface and call it a day.
On the hardware side: Aircove is a Wi-Fi 6 router with ExpressVPN built directly into the firmware. Every device on the network is automatically protected — no per-device app installs, no connection slots consumed. Aircove Go is the portable version: USB-C powered, pocket-sized, and travel-ready. Advanced and Pro subscribers get hardware discounts. Both are the cleaner solution for households with smart TVs, game consoles, or any screen that can't run a VPN app.
Pros & Cons Overview
The Good Stuff
- ✓Lightway rebuilt in Rust with post-quantum (ML-KEM + P521) encryption on by default.
- ✓TrustedServer RAM-only infrastructure — no persistent storage possible, anywhere.
- ✓19 independent audits by five separate firms — the most verified no-logs policy in the industry.
- ✓Best-in-class streaming: every major platform, every tested library, first try.
- ✓2026 pricing overhaul brings Basic plan to $2.79/mo — directly competitive with NordVPN.
- ✓Full privacy suite included: password manager, email relay, private AI, ID protection.
- ✓Best app design in the category across every platform, including a full Linux GUI.
The Not-So-Good
- ✗Renewal pricing is sharply higher — Basic renews at $99.95/yr (~$8.33/mo) after the intro period.
- ✗Pro-tier Identity Defender is US-only for most features; international subscribers pay Pro price for less.
- ✗No multi-hop or double VPN — NordVPN and ProtonVPN both offer this.
- ✗Lightway Turbo (up to 330% speed gain) is currently Windows-only.
- ✗Kape Technologies ownership history is worth knowing for high-risk users.
The Final Verdict
ExpressVPN in 2026 is a different product from what I reviewed six months ago. The pricing overhaul removes the primary objection most people had. The Lightway-in-Rust plus post-quantum combination is legitimately ahead of the field on security engineering. Nineteen audits from five firms is an accountability track record no competitor matches. And the full privacy suite — password manager, email relay, private AI, identity protection — positions this as something closer to a complete digital privacy platform than a traditional VPN.
The Kape ownership history is still worth knowing. The Pro-tier geographic gap on Identity Defender is a real problem that should stop international subscribers from going past Advanced. Lightway Turbo being Windows-only means Mac and mobile users don't yet see the headline speed numbers. These are real limitations, not marketing-speak asterisks.
For most people: Basic 2-year at $2.79/month is the call. If you want the password manager, Advanced. Hold off on Pro unless you're in the US and will actually use Identity Defender — you're paying a significant premium for features that may not apply to your geography.
Free checklist
10 Security Moves That Take 10 Minutes
No fluff. Quick wins you can actually do today — VPN, passwords, 2FA, and more.
No spam. Unsubscribe anytime.