Affiliate links present. Disclosure
ExpressVPN
The VPN that hides a lot of engineering behind one calm dashboard — simple on the surface, serious underneath
Pick ExpressVPN if you want the VPN to disappear into the background and you are comfortable paying for that polish. Skip it if multi-hop or squeezing maximum feature value from every dollar is the main mission.
Fact-checked and maintained by Softplorer Research
ExpressVPN is for the person who wants the technology to do its job without making a speech about it every time you connect. That simplicity is not empty packaging: the app deliberately keeps the controls simple, independent audits have checked important parts of the privacy and security story, the VPN fleet uses RAM-only infrastructure, and there is a real legal event showing what happened when authorities went looking for logs. The trade is that a few power-user wishes — multi-hop, unlimited connections, lots of server knobs — simply are not the point here. Think good hotel shower: turn one handle and it works; wonderful until you are the person who actually wants to adjust the boiler.
At a glance
Right fit if
- You want the VPN equivalent of an automatic car: choose where you are going, not how the gearbox feels about it.
- You want VPN coverage at the router level without treating router setup as your new weekend hobby.
- You have a TV or other awkward device where a normal VPN app is not the easiest route and want a SmartDNS option available.
Not the right fit if
- You want every client app open for inspection. Lightway's core is published, but you shouldn't assume the full client apps are open source.
- You specifically want multi-hop routing. There is no hidden toggle to discover later — multi-hop isn't available.
- Your household needs unlimited simultaneous connections. Capped at 10-14 depending on plan — not unlimited on any tier. You may eventually become the person asking 'who is still connected to the old tablet?'
- You are shopping primarily on price. Annual/renewal plan priced above median for category. The polished experience comes with a premium-positioned bill.
Score breakdown
Scale reflects category fit and operational confidence — not absolute product quality.
Tap WHY to see the verdict · HOW to see the evidence
Privacy pages are easy to make pretty. The useful question is whether there is anything behind the curtain you can actually inspect.
Privacy claims are easy to make. What matters is whether there are receipts: independent checks, public reports, clear ownership, and real-world evidence where it exists. A promise on a homepage is nice; something you can verify is better.
What exists
- Repeated independent assessments by multiple firms across privacy, apps, protocols, and server technology; exact cumulative totals are not frozen into evergreen scoring copy
- Trust Center — KPMG report requires accepting KPMG's own T&Cs but no ExpressVPN account
- regular audit cadence across different areas and firms, multiple per year
- January 2017 Turkey server seizure (Karlov assassination investigation) — server held no logs, ExpressVPN could not identify the customer
- Lightway core on GitHub
- BVI — not in any eyes alliance
- BVI: no mandatory data retention legislation
- withdrew physical India servers in 2022 rather than comply with CERT-In mandatory data-retention rules
What's missing
- former CIO/CTO Daniel Gericke: 2021 DOJ DPA over pre-employment UAE 'Project Raven' work (2016-2019); departed ExpressVPN 2023, not 2019 as previously recorded
- client apps closed source — Lightway protocol core only is published
- Kape Technologies parent (formerly Crossrider): adware distribution documented in security databases prior to 2018 rebrand
- Kape also owns CyberGhost and PIA — three competing VPN brands under one parent, all reviewed separately by Softplorer
- no warrant canary published
- no physical cash option
Security features are tools in a drawer: the impressive count matters less than whether the right tool is there when something goes wrong.
Here the score counts protections that are actually confirmed, then checks the awkward gaps that only show up when something goes wrong. It is less 'how many switches are in the app?' and more 'which ones matter when the Wi-Fi drops at the worst possible moment?'
What exists
- WireGuard available as manual selection on Android, iOS, macOS, Windows, Linux, Apple TV
- Lightway (default) + WireGuard (optional) — both available
- OpenVPN UDP and TCP
- post-quantum protection via ML-KEM (NIST standard) integrated into Lightway — enabled by default on all platforms
- firewall-level enforcement on desktop platforms; Advanced Kill Switch achieves equivalent full-traffic blocking on iOS
- Network Lock (desktop) and Standard Kill Switch (iOS) enabled by default
- Advanced Kill Switch on iOS blocks all network traffic, matching desktop-grade firewall lockdown — the capability genuinely exists
- own DNS servers
What's missing
- the full-block Advanced Kill Switch is NOT the default on iOS — only the lighter Standard mode is; users must manually switch to Advanced for desktop-equivalent lockdown
- WebRTC protection via browser extension only — not in VPN app
- obfuscation implementation not covered by separate independent audit
- no multi-hop routing
Streaming support is a moving target. Today's green light can turn red after a service changes its blocking, so treat this like a weather report, not a wedding vow.
For streaming, we only give credit for what can be verified now. One successful Saturday night does not become a forever promise, because streaming services change the locks whenever they feel like it. Platform Unblocking is only partially confirmed, so not every detail there should be treated as settled.
What exists
- all servers + MediaStreamer SmartDNS
- MediaStreamer for non-VPN devices
- multiple regions reported accessible
- Disney+, Prime, BBC iPlayer, Hulu reported
What's missing
- no platform-specific labeled streaming servers
Unresolved
- Absence of a published permanent guarantee is not scored as a confirmed negative — unresolved
VPN speed is not one horsepower number. Your protocol, route, server, and location all get a vote.
This score is not built from one heroic speed-test screenshot. It looks at the pieces that can affect day-to-day performance and keeps anything unverified out of the victory speech.
What exists
- WireGuard available on Android, iOS, macOS, Windows, Linux, Apple TV — manual selection
- Lightway (primary) + WireGuard (optional) both available
- Lightway audited: Cure53 (2021, 2022), Cure53+Praetorian (2024)
- TrustedServer RAM-only — entire VPN fleet
- PwC and Cure53 audits of TrustedServer architecture
Unresolved
- Server Fleet — not reliably verified right now
A VPN can be brilliant underneath and still make you hunt through Settings like you're looking for the fuse box in someone else's house.
For app experience, the useful question starts after installation: can you connect quickly, find the useful controls, and understand what a switch does without opening a support article in another tab? Connection Ux is only partially confirmed, so not every detail there should be treated as settled.
What exists
- Windows, macOS, Linux
- iOS, Android
- Amazon Fire TV, Android TV, Apple TV (tvOS 17+) native apps
- Chrome, Firefox, Edge, Brave
- native tvOS app available from App Store for Apple TV HD and 4K (tvOS 17+)
- official ExpressVPN GUI app for Linux is documented as a current supported app
- Full app-based on Windows/Android/Linux; app+IP-level on macOS (Qt beta app); IP/website-based exclusion on iOS
- present in some form on every major platform, though iOS is limited to IP/website exclusion due to Apple's OS-level restriction, not an ExpressVPN choice
What's missing
- no advanced server filtering or load indicators
This is the boring category that becomes important the second your laptop has the feature and your phone does not.
Here we check where the important features really work, device by device. 'Supported' on the homepage is not much comfort if the exact button you need vanishes when you move from your laptop to your phone.
What exists
- Chrome, Firefox, Edge, Brave
- controls desktop app — system-level tunnel
- Aircove — own VPN router product
- guides for Asus, DD-WRT, Linksys, Netgear
What's missing
- capped at 10-14 depending on plan — not unlimited on any tier
Unresolved
- The plan-dependent connection allowance is not scored as “generous”; that label has no fixed threshold — unresolved
The number on the signup button is the first date, not the marriage. Renewal, refunds, and what disappears after the trial period matter later.
For value, look past the shiny first price. Renewal terms, refunds, free-plan or trial limits, and what you actually keep after the honeymoon period matter more than a giant discount badge.
What exists
- all plans and prices listed, including renewal rates in checkout footnotes
- monthly plan available
- 30-day refund available
- 30-day money-back on direct purchases
What's missing
- promotional rate does not carry over — introductory rate increases materially at renewal
- annual/renewal plan priced above median for category
- monthly plan significantly more expensive than annual per-month rate
- no free plan
- refund requires live chat or support contact
- App Store/Google Play purchases excluded — those go through Apple's/Google's own refund process instead, at their discretion
Uptime is hard to verify from the outside, so a quiet week on the internet is not treated as proof. Documented infrastructure and real incident handling matter more.
This is the category where guessing gets you into trouble. If there is no solid uptime or incident evidence, it stays unresolved instead of getting a gold star because nobody complained loudly this week. Server Fleet Stability is only partially confirmed, so not every detail there should be treated as settled. Incident Communication is only partially confirmed, so not every detail there should be treated as settled.
What exists
- TrustedServer — all VPN servers RAM-only
- PwC audit of TrustedServer published
- the 2021 IPsec exposure was found internally and published via Trust Center before external discovery — the disclosure practice, not the incident itself, is the positive signal
- Trust Center used for incident disclosure
What's missing
- TrustedServer covers VPN exit servers only — DNS and support infrastructure not in scope
- 2021 IPsec key exposure on Linksys router configuration is a documented infrastructure-adjacent incident — not a spotless record
Unresolved
- Failure to find a public consumer uptime SLA is not scored as a confirmed negative — unresolved
- A broad historical-quality judgment is not a discrete event-backed signal and is not scored — unresolved
Trade-offs
- No multi-hop routing. If two VPN hops are part of your normal threat model, this is a real feature gap, not a settings puzzle.
- Promotional pricing does not carry over unchanged to renewal. The first bill is the welcome mat, not the rent forever.
- Connections are capped rather than unlimited. Capped at 10-14 depending on plan — not unlimited on any tier.
When it breaks
- On mobile, the strongest lockdown mode is not simply the default setting. The full-block Advanced Kill Switch is NOT the default on iOS — only the lighter Standard mode is; users must manually switch to Advanced for desktop-equivalent lockdown. The safety net exists, but the thickest version still needs you to choose it.
- If your threat model suddenly grows from 'coffee-shop Wi-Fi' to 'route traffic through two VPN servers', ExpressVPN does not grow that extra leg with you. Multi-hop is not available.
- If you bought through an app store, the normal direct-purchase refund path does not automatically follow you. App Store/Google Play purchases excluded — those go through Apple's/Google's own refund process instead, at their discretion. Same product, different cashier, different return counter.
- If you love sorting servers by every possible metric, the interface may feel intentionally sparse. No advanced server filtering or load indicators. That simplicity is pleasant until the day you want the missing knob.
Hidden trade-offs
- The introductory price is not a promise about renewal. Put the renewal date in your calendar before the discount turns into a surprise guest on the card statement.
- Corporate ownership is part of the trust picture too. Kape Technologies parent (formerly Crossrider): adware distribution documented in security databases prior to 2018 rebrand. You can still like the product while keeping that history in view.
- ExpressVPN, CyberGhost, and PIA are not three completely unrelated corporate bets. Kape also owns CyberGhost and PIA — three competing VPN brands under one parent, all reviewed separately by Softplorer. That matters if spreading provider risk is part of your plan.
- TrustedServer is important, but do not stretch the label beyond its documented scope. TrustedServer covers VPN exit servers only — DNS and support infrastructure not in scope.
Sources
Building a complete privacy stack?
A VPN handles network-level encryption. Password managers and antivirus cover the gaps it can't.
Quick comparisons
© 2026 Softplorer