ExpressVPN Review

ExpressVPN is technically one of the best VPNs on the market. Its Lightway protocol is fast, its RAM-only server infrastructure is genuinely privacy-forward, and its network spans 105 countries — more than almost any competitor. If you judge a VPN purely on what the software does, ExpressVPN earns its reputation.

The problem is that ExpressVPN is no longer a scrappy privacy startup. In 2021 it was acquired by Kape Technologies for $936 million — the largest deal in consumer VPN history. Kape’s predecessor company was associated with adware distribution. That history doesn’t automatically make ExpressVPN unsafe, but it does raise a question every serious buyer should consider before handing over their browsing data.

This review is built around that tension. ExpressVPN earns an 85/100 — strong technical execution, genuine transparency efforts, but a cloud of ownership skepticism that more privacy-focused options don’t carry.

---

History & Ownership

ExpressVPN was founded in 2009 and incorporated in the British Virgin Islands (BVI) — a jurisdiction outside the Five Eyes and Fourteen Eyes intelligence alliances, with no mandatory data retention laws. For its first decade, it was independently operated and widely respected in the privacy community.

That changed in September 2021 when Kape Technologies completed its $936 million acquisition of ExpressVPN. Kape also owns CyberGhost, Private Internet Access, and Zenmate — giving a single holding company control over some of the most-used VPN brands in the world.

The controversy stems from Kape’s history. The company was previously known as Crossrider, a software platform associated with distributing adware and potentially unwanted programs. Crossrider rebranded as Kape Technologies in 2018 and pivoted into the privacy and security space, but critics argue the cultural distance from that history isn’t sufficient.

“Kape’s rebranding doesn’t erase its history — but what matters most is whether ExpressVPN’s infrastructure and audits are trustworthy today, not what the parent company was called in 2014.”

There’s also the matter of Daniel Gericke, ExpressVPN’s former CTO. In 2021 — prior to the Kape acquisition closing — it emerged that Gericke had previously worked on a surveillance project for the UAE government, which the U.S. DOJ charged as an unlawful hacking-for-hire operation. ExpressVPN disclosed this proactively and Gericke has since departed the company, but the episode added to the cloud around the brand.

What ExpressVPN has done in response: published a transparency report, commissioned independent audits of its no-logs policy and security infrastructure, and maintained its BVI incorporation. These are meaningful actions. Whether they’re sufficient is a judgment call each reader needs to make.

---

Security & Privacy

Despite the ownership concerns, ExpressVPN’s technical privacy implementation is genuinely strong. This is where the gap between perception and performance is widest.

TrustedServer: RAM-Only Infrastructure

ExpressVPN’s TrustedServer technology requires that all VPN servers run entirely on RAM rather than hard drives. The practical effect: every time a server is rebooted, all data is wiped. There’s nothing persistent for a government or attacker to seize.

This claim was put to a real-world test in 2017 when Turkish authorities seized an ExpressVPN server related to a murder investigation. The server contained no useful data. That incident — before TrustedServer was formally branded and launched — gave early evidence that the no-logs policy held up under pressure.

Lightway Protocol

ExpressVPN’s Lightway protocol is the company’s proprietary open-source VPN protocol, built on the wolfSSL cryptography library. It’s designed to connect faster than WireGuard, drop and reconnect more gracefully on network switches (e.g., moving from Wi-Fi to cellular), and use less battery on mobile.

Lightway has been independently audited by Cure53, a well-regarded security firm. The open-source release means the code can be reviewed by anyone, which is a meaningful transparency commitment.

Independent Audits

ExpressVPN has commissioned audits from multiple credible firms:

• PwC — No-logs policy audit (2019)
• KPMG — No-logs policy audit (2022)
• Cure53 — Lightway protocol security audit; browser extension audit; app audits across platforms
• F-Secure — Browser extension audit

This volume of auditing is above average for the industry. ExpressVPN publishes its security audit summaries and transparency reports publicly. Audits have limitations — they assess a snapshot in time, not ongoing operations — but multiple firms finding no material issues across years provides meaningful evidence.

Encryption Standards

• AES-256 encryption (OpenVPN/IKEv2) or ChaCha20 (Lightway)
• 4096-bit RSA for key exchange
• HMAC SHA-512 for authentication
• Perfect forward secrecy on all connections
• Kill switch on all platforms
• DNS leak protection built in
• Split tunneling available (Windows, Mac, Android, routers)

Jurisdiction

The BVI incorporation remains a meaningful privacy advantage. British Virgin Islands courts don’t have jurisdiction to compel disclosure to U.S. or EU law enforcement without independent BVI legal process.

---

Speed & Performance

ExpressVPN ranked 8th out of 22 providers in our speed lab testing, delivering a median of 630 Mbps on a 1 Gbps connection with 22ms latency on nearby servers.

That’s a strong result but not a market-leading one. NordVPN, Surfshark, and a handful of others consistently outperform ExpressVPN on raw throughput. The gap is meaningful primarily at the top end — for users with gigabit connections, you’ll notice ExpressVPN isn’t squeezing all available bandwidth.

Metric	ExpressVPN	Industry Average
Median download speed	630 Mbps	~480 Mbps
Speed lab rank	#8 of 22	—
Latency (nearby server)	22 ms	~28 ms
Countries	105	~60
Servers	3,000+	~2,500

Where ExpressVPN Is Fast

Lightway’s fast connection times are a real-world advantage even when raw throughput isn’t best-in-class. Switching networks (Wi-Fi to LTE) causes less disruption than with OpenVPN or even WireGuard. For mobile users, Lightway produces noticeable UX improvements that raw Mbps numbers don’t capture.

The 105-country network is the largest we’ve tested. For travelers needing servers in less common regions — Southern Africa, Central America, Southeast Asia — ExpressVPN’s reach is a genuine differentiator. Most competitors stop at 60-75 countries.

---

Streaming

Streaming performance is a strength. ExpressVPN reliably unblocks:

• Netflix (multiple regional libraries including US, UK, Japan, Australia)
• Disney+
• BBC iPlayer
• Hulu
• Amazon Prime Video
• HBO Max
• Peacock
• DAZN
• Hotstar
• ESPN+

That’s 10+ services across regions, which puts ExpressVPN in the top tier for streaming access. The MediaStreamer feature adds DNS-level smart DNS functionality — useful for devices that can’t run a full VPN client (smart TVs, older gaming consoles, Apple TV without sideloading).

ExpressVPN tends to maintain streaming access longer after provider crackdowns than most competitors, which is consistent with the company’s historical reputation. There are occasional outages — no VPN maintains 100% streaming uptime against adaptive geo-restriction systems — but recovery is typically fast.

---

Pricing & Plans

ExpressVPN is expensive by any honest comparison. The monthly rate is $12.95 — among the highest in the category. The long-term plan brings it to $3.49/month (billed annually with a 4-month bonus), which is competitive, but still above Surfshark and CyberGhost at comparable commitment levels.

Plan Comparison

Plan	Monthly Price	Included Extras
Basic	$3.49/mo (1-yr + 4 mo)	Core VPN features
Advanced	$4.99/mo (1-yr + 4 mo)	Core VPN + eSIM data plan
Pro	$6.25/mo (1-yr + 4 mo)	Core VPN + eSIM + password manager + cloud backup

The Advanced plan’s eSIM feature is genuinely novel — it provides mobile data connectivity in 200+ countries, which is useful for frequent international travelers who want to avoid roaming charges or country-specific SIM cards. The Pro plan’s password manager and cloud backup are commodity features available cheaper elsewhere; they’re convenience bundles, not differentiators.

What You’re Actually Paying For

At $3.49/month committed, you’re getting:

• 8 simultaneous connections
• Access to 3,000+ servers in 105 countries
• Lightway protocol
• 24/7 live chat support
• 30-day money-back guarantee
• Router app (Aircove)

The 30-day money-back guarantee is risk-free for evaluation. Customer support is 24/7 live chat with generally fast response times — this is a meaningful differentiator versus competitors where support means asynchronous email.

Connections: A Notable Limitation

ExpressVPN allows 8 simultaneous connections. Surfshark allows unlimited. NordVPN allows 10. For households with multiple users and devices, 8 connections can become a real constraint, especially if you’re also covering routers (which count as a single connection but protect all devices behind them). The Aircove router partially addresses this — all devices on the router network count as one connection — but only if you own an Aircove.

---

Who Should Use ExpressVPN

Best fit for:

• Users who prioritize streaming access and want reliable, wide-service coverage
• Frequent international travelers who need servers in less common countries
• Router users who want native VPN support via the Aircove hardware
• Users who want heavy audit trails and are willing to accept the Kape ownership tradeoff
• Anyone willing to pay a premium for a polished, cross-platform UX

Not the best fit for:

• Privacy-maximalist users who won’t accept Kape’s history on principle — Mullvad or ProtonVPN are better choices
• Budget-conscious users — Surfshark and CyberGhost deliver strong value at lower prices
• Power users who need unlimited connections for large households
• Users who want the fastest raw throughput — NordVPN and a few others beat ExpressVPN in speed labs

---

Limitations

No review at this standard should gloss over what ExpressVPN gets wrong.

1. Kape Technologies ownership. This is the biggest limitation and it’s not a technical one. Kape’s Crossrider history, the UAE surveillance contractor incident (even though the relevant executive has departed), and the concentration of multiple VPN brands under one holding company all raise questions. ExpressVPN’s audits and transparency reports are meaningful mitigations — but they don’t eliminate the concern for users whose threat model includes the VPN provider itself.

2. Price premium. At $3.49/month committed, ExpressVPN costs roughly twice what Surfshark charges for comparable features. The extras are real — 105 countries, Lightway, strong support — but the gap is hard to justify for users who aren’t specifically benefiting from those differentiators.

3. Eight-connection limit. In a world where several competitors offer unlimited simultaneous connections, 8 is a constraint that families or multi-device power users will feel.

4. Speed rank #8. Not a fatal flaw — 630 Mbps is fast enough for any real-world use case — but if raw speed is the primary criterion, ExpressVPN isn’t the leader.

5. No native WireGuard. ExpressVPN uses its own Lightway protocol instead of WireGuard. Lightway is technically comparable and open-source, but users who specifically want WireGuard’s established protocol history won’t get it here.

---

Frequently Asked Questions

Is ExpressVPN safe after the Kape acquisition?

This is the right question to ask. The honest answer is: the technical infrastructure remains strong and the audits are credible, but the ownership change is a legitimate concern. Kape’s history with Crossrider/adware is real. What matters is whether ExpressVPN’s infrastructure actually protects your data — and the independent audits, RAM-only servers, and the 2017 Turkish seizure incident all suggest the no-logs policy is real and operational. If your threat model specifically includes your VPN provider (or its parent company), providers like Mullvad or ProtonVPN offer cleaner corporate histories. If your threat model is primarily about ISP surveillance and geo-restriction, ExpressVPN’s technical implementation is sound.

Does ExpressVPN keep logs?

ExpressVPN’s no-logs policy covers browsing history, DNS queries, IP addresses, and traffic metadata. The policy has been audited by PwC and KPMG and was validated in practice by the 2017 Turkish server seizure, where authorities found no useful data. Minimal operational data (aggregate bandwidth, connection success/failure) is collected for service quality purposes but is not tied to individual users or activities.

Does ExpressVPN work in China?

ExpressVPN has historically been one of the more reliable VPNs for users in China, due to obfuscation technology that disguises VPN traffic as regular HTTPS. Reliability in China fluctuates — no VPN maintains consistent access during periods of aggressive enforcement (major political events, national holidays). ExpressVPN’s China performance is generally above average but not guaranteed.

What is Lightway and how does it compare to WireGuard?

Lightway is ExpressVPN’s proprietary open-source VPN protocol, built on the wolfSSL library. Like WireGuard, it’s designed for speed, lean code (roughly 2,000 lines vs WireGuard’s ~4,000), and fast reconnection. Lightway performs comparably to WireGuard in speed tests and is audited by Cure53. The primary difference is lineage: WireGuard is community-developed and widely reviewed over years; Lightway is ExpressVPN’s creation, open-sourced but not as broadly stress-tested. Both are meaningfully more secure and faster than OpenVPN.

Can I use ExpressVPN on my router?

Yes. ExpressVPN’s Aircove router provides native VPN support with a dedicated app — no manual configuration needed. The Aircove lets you create separate device groups with different VPN server connections (or no VPN) simultaneously. All devices connected to the Aircove count as a single VPN connection, which effectively removes the 8-connection limit for home setups. Aircove is sold separately from the VPN subscription.

---

The Bottom Line

Score: 85/100 — Technically excellent, ownership transparency required.

ExpressVPN earns its premium reputation on technical merit. The Lightway protocol is fast and open-source. TrustedServer’s RAM-only architecture is genuinely privacy-forward. The 105-country network is the widest available. Streaming support is reliable. Audits are frequent and credible.

The Kape Technologies acquisition is a real concern that deserves honest acknowledgment. It doesn’t make ExpressVPN technically unsafe — the audits and seizure history suggest the no-logs policy holds operationally. But it does mean you’re trusting a holding company with a problematic corporate ancestry. That’s a tradeoff each user has to evaluate for their own threat model.

If you’re choosing a VPN primarily for streaming, travel, and general privacy — and you’re comfortable with the Kape context after understanding it — ExpressVPN is a strong, well-supported choice. If the ownership history is disqualifying for you, ProtonVPN or Mullvad offer comparable or stronger privacy with cleaner histories. If price is the deciding factor, Surfshark delivers most of ExpressVPN’s capabilities at a substantially lower cost.

For further comparisons, see our best VPN guide and the full VPN comparison table.