ExpressVPN Review (Oct 2026): Prices, Audits, Incidents

ExpressVPN is worth its $2.99 a month if you buy the only plan it publishes. That is the 28-month “2 Years + 4 Months” Basic term, billed at $83.72. It suits you if you want:

• split tunneling on every platform
• a protocol with post-quantum protection switched on by default
• the longest audit list in the industry

It is a poor buy if you want a short term, because the monthly and 12-month prices appear only at checkout. It is also a poor buy if you want multi-hop, which it does not offer. The renewal price, $99.95 a year, is printed on the order page. That is more than Surfshark discloses. Against these strengths, ExpressVPN has four incidents on the record since 2017. It is also owned by Kape Technologies, which owns CyberGhost and Private Internet Access too. This review gives every number with its date and source. Our score for ExpressVPN is shown above.

Privacy and logging

ExpressVPN is run by Express Technologies Ltd. under the law of the British Virgin Islands (BVI). The BVI is outside the 5, 9 and 14 Eyes, the alliances of countries that share intelligence. The company says it “operates from” the BVI and does not name a headquarters city. Its terms of service are dated 27 July 2026 and its privacy policy 2 October 2026. Both name Express Technologies Ltd., where older documents named ExpressVPN International Ltd. Since 2021 the ultimate owner has been Kape Technologies. Kape also owns CyberGhost and Private Internet Access. So three of the twelve providers we track answer to the same group.

The privacy policy says ExpressVPN never collects two kinds of logs:

• activity logs: browsing history, traffic destination, data content and DNS queries
• connection logs: your IP address, the outgoing VPN IP address, connection timestamps and session duration

It does collect aggregated usage statistics:

• which apps and versions have been activated
• whether a VPN connection succeeded on a given day
• the VPN location chosen
• the total data transferred

The company describes these statistics as aggregated. The audits below exist to test that design.

KPMG has audited the no-logs policy three times:

• an ISAE 3000 Type 1 engagement in September 2022
• a second assurance review of the privacy-policy claims in December 2023
• a third, announced on 25 June 2025, which assessed the claims as of 28 February 2025

The third audit used the ISAE (UK) 3000 Type 1 standard. It reported no issues with the technical safeguards against activity logging. Earlier, in June 2019, PwC Switzerland audited privacy-policy compliance and the TrustedServer technology. Cure53 audited TrustedServer in May 2022. Where ExpressVPN’s own pages give only a month, our data record uses the first of that month, and so does this review. You can read the KPMG report pages once you accept KPMG’s terms. NordVPN’s and Surfshark’s reports, by contrast, sit behind a customer login.

The apps have been audited many times:

• Cure53 tested the iOS app in September 2022, the Android and Linux apps in August 2022 and the macOS app in July 2022.
• F-Secure tested the Windows v12 app in April 2022, after testing the v10 app in March 2022.
• Nettitude tested the Windows apps in March and April 2024 to confirm the DNS fix described below. It found one medium-severity issue, which was fixed.
• Cure53 audited the browser extension in October and November 2018. The extension’s source code was later published under GPLv2, an open-source license. Cure53 audited the extension again in October 2022, together with the ExpressKeys extension, and in June 2024.
• Cure53 audited the Aircove router in July 2022 and November 2024.

The Trust Center lists 28 audits from 2018 to May 2026. They include 2026 Cure53 assessments of non-VPN products. The Trust Center also lists ISO 27001, 9001 and 18295 certifications.

ExpressVPN publishes a transparency report every six months. For January to June 2026, it records:

• 137 government, law-enforcement and civil requests
• 1,361,382 DMCA notices, which are copyright complaints under US law
• 3 warrants

It states that none of the requests led to the disclosure of user-related data. There is no warrant canary.

Four incidents are on the record. Our data record includes all four, with the dates below.

In January 2017, Turkish authorities seized a physical ExpressVPN server from a datacenter. They were investigating the assassination of the Russian ambassador, Andrei Karlov. The server had carried the connection used to delete the shooter’s Gmail and Facebook accounts. TorrentFreak’s Ernesto Van der Sar reported it on 19 December 2017. ExpressVPN stated that it “does not and has never possessed any customer connection logs”. It said the seized server yielded no useful information. It also said it had stopped using physical servers in Turkey. Our record rates this low severity, because the seizure tested the no-logs claim and the claim held.

On 16 September 2021, ExpressVPN acknowledged news reports about its chief information officer, Daniel Gericke. He had earlier worked on Project Raven, a surveillance operation for the United Arab Emirates. That matter was resolved in an investigation that month. ExpressVPN said it had hired him in December 2019 knowing his background. It also said “we do not condone Project Raven”. It said it would audit more often, with outside firms recertifying its privacy policy every year. The yearly KPMG audits that followed are the measurable result.

On 8 February 2024, ExpressVPN disclosed a DNS problem in its Windows v12 app. DNS requests are the lookups that turn website names into addresses. In the split-tunneling mode “Only allow selected apps to use the VPN”, some of them went to the DNS servers of the user’s internet provider instead of ExpressVPN’s own. CNET’s Attila Tomaschek found the problem. It affected an estimated under 1% of Windows users. ExpressVPN turned off split tunneling on Windows until the fix shipped. The feature came back in April 2024, and Nettitude verified the fix. Our record rates this one medium, because an internet provider could see which domains affected users visited.

On 18 July 2025, ExpressVPN disclosed a leak in its Windows app. Debug code had shipped in versions 12.97 to 12.101.0.2-beta. It let TCP traffic on port 3389, which Remote Desktop uses, bypass the VPN tunnel. A bug-bounty researcher reported it on 25 April 2025. Version 12.101.0.45 fixed it five days later. ExpressVPN rated the chance of real-world exploitation as extremely low. Only the user’s real IP address was exposed, and only on that one port. Our record rates it low.

How you pay also affects your privacy. ExpressVPN takes:

• cards: Visa, Mastercard, American Express, Discover, JCB, Diners Club and several regional cards
• PayPal, Apple Pay and Google Pay
• in-app purchases on the Apple and Google stores

A support article dated 11 August 2026 says cryptocurrency, including BitPay, is no longer accepted. So there is no longer a way to pay ExpressVPN without a method linked to your identity. NordVPN, Surfshark, Proton VPN and Mullvad all still take crypto or cash.

Security features

A protocol is the set of rules a VPN uses to build its encrypted connection. Lightway is ExpressVPN’s own protocol and the default. It was rewritten from C into Rust and uses the wolfSSL cryptography library. It includes post-quantum protection by default, using ML-KEM, the NIST standard, in a hybrid key exchange. Post-quantum protection is designed to resist attacks from future quantum computers. ExpressVPN switched it on by default on 23 October 2023, using Kyber at the time. Its Lightway page now names ML-KEM as the algorithm.

The Lightway core is open source on GitHub, so anyone can read the code. It has been audited four times:

• by Cure53 in August 2021, when it was open-sourced
• by Cure53 again in November 2022
• by Praetorian in September 2024, after the Rust rewrite
• by Cure53 in October 2024, also after the rewrite

Lightway runs in the Android, iOS, Windows, Mac, Linux and router apps. A Lightway Turbo mode is currently Windows-only. WireGuard, OpenVPN and IKEv2 are also offered, and the features page states AES-256 encryption.

A kill switch blocks your internet if the VPN connection drops. ExpressVPN calls its kill switch Network Lock. It is on by default on Windows, macOS, Linux and Android, and it is always on in the iOS app. It blocks IPv4, IPv6 and DNS traffic outside the tunnel.

Split tunneling lets you choose what goes through the VPN and what uses your normal connection. ExpressVPN offers it on every platform, but it works differently on each. On Windows it covers apps and websites. On Linux it covers apps, IP addresses and subnets. On Android it works per app. On iOS it lets you exclude IPv4 addresses. The Mac app has it too.

Obfuscation disguises VPN traffic so that networks cannot easily spot and block it. ExpressVPN makes it automatic on every server, rather than a mode you switch on. That makes ExpressVPN simpler than Surfshark or NordVPN on restrictive networks. But it also means you cannot see or choose it. Advanced Protection blocks ads, trackers and malicious sites. ExpressVPN runs its own zero-knowledge DNS on every server.

The network is RAM-only under the TrustedServer design, which wipes every server on reboot. It covers 113 countries across 214 server locations. ExpressVPN does not publish a server count, which is unusual among the big brands. Many locations are marked as virtual, which means the server is physically somewhere else. So our record lists the city count as unknown. ExpressVPN does not state who owns its servers.

Some features are missing or limited. Multi-hop sends your traffic through two servers instead of one. No official ExpressVPN page documents a multi-hop feature, while NordVPN, Surfshark and Proton VPN all offer one. Port forwarding exists only on the router app and the Aircove router. It runs outside the VPN tunnel, so it is not a torrenting feature in the usual sense. IPv6 is blocked rather than sent through the VPN. A dedicated IP is a paid add-on, and it is included with the Express Pro tier.

Apps and usability

ExpressVPN has apps for Windows, Mac, Linux, iOS, Android, Apple TV, Fire TV Stick and Android TV. It has browser extensions for Chrome, Firefox, Edge and Brave. Its router app also ships on its own Aircove and Fortify routers. Samsung TVs, Roku and Chromecast use MediaStreamer, a Smart DNS service, rather than an app. The device limit depends on the tier:

• 10 devices at the same time on Basic
• 12 on Advanced
• 14 on Express Pro

That is below Surfshark’s unlimited allowance but above CyberGhost’s 7. Advanced and Express Pro also bundle ExpressKeys, an eSIM and Identity Defender, which is for the US only.

ExpressVPN’s support guide to streaming lists Netflix, Hulu, Disney+, BBC iPlayer, Prime Video and HBO as services you can access. Separate pages make the same claim for Max, YouTube TV, DAZN, Paramount+, ESPN+, Crunchyroll and Peacock. We have not yet tested any of them. So the table above records them as ExpressVPN’s documented claims. Our ExpressVPN and Netflix guide will carry the lab results. We have not yet tested speed in our lab either.

The browser extension and the Lightway core are open source. The extension was open-sourced in 2019 under GPLv2. The main apps are closed source. Proton VPN, Mullvad and IVPN go further and publish the code for their apps. We have not yet published our own usability tests or screenshots. If the app will not connect, our ExpressVPN not working guide lists the causes in order.

Support

Live chat is available 24/7. There is also email support and a large knowledge base, and refunds go through live chat too. We have not yet measured response times. So the support score reflects what is available, not how good it is. The knowledge base has one gap for shoppers. A page updated 30 October 2026 confirms that monthly and 12-month plans exist, but it does not state their prices.

Plans and the renewal price

ExpressVPN sells three tiers. On 31 October 2026 its order page showed exactly one term for each: “2 Years + 4 Months”, billed for the first 28 months.

• Basic cost $2.99 a month, or $83.72, advertised as 80% off.
• Advanced cost $4.49 a month, or $125.72, advertised as 73% off.
• Express Pro cost $7.49 a month, or $209.72, advertised as 67% off.

Each line carries the words “Then autorenews at” and the renewal price. Basic renews at $99.95 a year, Advanced at $119.95 and Express Pro at $199.95. The Basic renewal works out at $8.33 a month, 2.8 times the introductory rate. That is a smaller jump than NordVPN’s 3.3 times, but it is still the number to write in your calendar. Sales tax is added at checkout where it applies.

A support page updated 30 October 2026 says monthly and 12-month plans exist for all three tiers. But their prices appear only at checkout, and they did not show in the pages we loaded. So our data record lists them as not published. That makes ExpressVPN the only provider in our table without a public monthly price. It also means we cannot tell you what a short commitment costs. Our ExpressVPN pricing page will record the price once we can read it. The ExpressVPN deals page compares the current promotion with the Black Friday VPN deals from other brands.

There is no free tier. ExpressVPN’s pages describe a 3-day free trial in its iOS and Android apps, through the app stores. A support page updated 14 October 2026 describes the 30-day money-back guarantee. It covers first-time customers for 30 days from the moment of purchase, including any dedicated IP add-on. You request it in live chat. Subscriptions bought through the Apple App Store or Google Play are outside the guarantee, and Apple or Google decides on those. Our ExpressVPN cancellation guide walks through the steps and the refund request.

Who it is for and who should skip it

ExpressVPN suits:

• people who want the same features on every device, especially split tunneling and a kill switch that is simply on
• people who connect from networks that block VPNs and would rather not think about obfuscation modes
• households with an Apple TV, a Fire TV and a router to cover
• anyone who values a long, public audit record and a renewal price stated up front

Skip it if:

• you want to pay month to month, or for a single year, at a known price
• you want multi-hop, or port forwarding inside the tunnel
• you need more than 10 devices on the cheapest tier
• you want to pay with cryptocurrency, which ended in August 2026

Some readers are uneasy that Kape Technologies owns three major VPNs. Others want open-source apps. For both, Proton VPN, Mullvad and IVPN are alternatives. If you use IPv6, look at Proton VPN. It is the one big brand in our table that routes IPv6.

Alternatives

NordVPN costs $3.49 a month on its 27-month Basic plan. That is $94.23, and it renews at $139.08 a year. NordVPN publishes a monthly price of $14.99 and has had six no-logs checks. It adds Double VPN and Meshnet. But it lacks split tunneling on macOS and iOS, and it has two incidents of its own. Our ExpressVPN vs NordVPN comparison goes through the differences line by line.

Surfshark is cheaper, at $2.49 a month for 27 months, or $67.23. It has unlimited devices and multi-hop. But it does not state its renewal price, has no port forwarding and retired SmartDNS in February 2026. See ExpressVPN vs Surfshark.

Proton VPN offers open-source apps, Swiss jurisdiction, Secure Core multi-hop, port forwarding and a free tier. It costs $3.49 a month on its 2-year Plus plan. That is $83.76, and it renews at $83.88 a year. Its published monthly price is $9.99. See ExpressVPN vs Proton VPN.

CyberGhost shares ExpressVPN’s owner. It costs $2.19 a month for 26 months. That is $56.94, and it renews at $56.94 a year. It has a 45-day refund. But it has no obfuscation, no multi-hop and a 7-device limit. See CyberGhost vs ExpressVPN.

Private Internet Access is also owned by Kape. It offers port forwarding, open-source apps and unlimited devices at $2.03 a month on a 39-month plan, or $79. It operates under US law. Mullvad charges a flat $5.60 a month, needs no email address and takes cash. It suits readers who want a way to pay anonymously again.

For rankings by use, see our best VPN for streaming, best VPN for Netflix and best VPN for travel pages, or the full provider list.

How we verified this review

We read every price, plan term, renewal amount, refund rule, country count and feature on this page from ExpressVPN’s official pages on 31 October 2026. The order page showed only the 28-month term. That is why we record the monthly and 12-month prices as not published rather than guess them. Audit dates come from ExpressVPN’s Trust Center and announcements. Where only a month is given, we use the first of that month. The four incidents are sourced to ExpressVPN’s own disclosures. For the 2017 seizure, we also cite TorrentFreak’s named report. ExpressVPN’s support article on renewing an account was last updated on 11 August 2026. It states that cryptocurrencies, including BitPay, are no longer accepted as a payment method. It adds that subscriptions bought with them earlier will not renew automatically. We have not yet run speed or streaming tests. That is why speed is left out of the score and streaming entries are labeled as claims. The data record behind this page is public. Our how we test page describes the lab that will replace the claims with measurements.