ExpressVPN review
ExpressVPN fits readers who value public audit reports and want a commercial VPN with Linux desktop and command-line support. Watch the ownership relationship: Kape also owns competing VPN brands and review sites, which creates a conflict to consider when weighing recommendations.
How we make money: links may become affiliate links, but our scoring code never sees commissions, and most providers listed pay us nothing.
Score breakdown
One formula for every commercial vpn, explained on how we score VPNs.
Plans and the true 3-year price
| Plan | Term | Monthly | Renews at | 3-year cost | Devices |
|---|---|---|---|---|---|
| Basic - 1 month | 1 month | €12.99 | €12.99 | €468 | 10 |
| Basic - 12 months + 3 months | 15 months | €4.49 | €6.66 | €207 | 10 |
| Basic - 2 years + 4 months | 28 months | €2.49 | €6.66 | €123 | 10 |
| Advanced - 1 month | 1 month | €14.99 | €14.99 | €540 | 12 |
| Advanced - 12 months + 3 months | 15 months | €5.49 | €9.16 | €275 | 12 |
| Advanced - 2 years + 4 months | 28 months | €3.99 | €9.16 | €185 | 12 |
| Express Pro - 1 month | 1 month | €19.99 | €19.99 | €720 | 14 |
| Express Pro - 12 months + 3 months | 15 months | €7.99 | €15 | €435 | 14 |
| Express Pro - 2 years + 4 months | 28 months | €6.49 | €15 | €302 | 14 |
Providers change prices often, and we regularly verify prices against their own pricing pages, though small differences from current prices are possible. Prices checked 11 Oct 2026. Refund window: 30 days.
Who it's for
Pick it if
- Public assurance reports matter to your privacy assessment.
- You want both a Linux GUI and a CLI.
- You want RAM-only servers and a post-quantum option.
- You value access to chat and email support.
Skip it if
- You need port forwarding.
- You want to pay with Bitcoin or Monero.
- You prefer to avoid shared ownership between VPN providers and review sites.
Audit evidence
| Date | Auditor | Type | Scope | Report |
|---|---|---|---|---|
| 28 Feb 2025 | KPMG | No-logs assurance | ISAE 3000 Type 1 (point-in-time) assurance on the TrustedServer system and privacy-policy controls against activity and connection logging | Public report |
| Nov 2024 | Cure53 | Other | Second security audit of the Aircove routers | Public report |
| Oct 2024 | Cure53 | Other | Fourth audit of the Lightway VPN protocol | Public report |
| Sept 2024 | Praetorian | Other | Third audit of the Lightway VPN protocol (security assessment with retest) | Public report |
| Jun 2024 | Cure53 | App / client | Second audit of the ExpressVPN browser extension | Public report |
| Apr 2024 | Nettitude | App / client | Penetration test of the Windows app to confirm remediation of a DNS issue in split tunneling | Public report |
| Dec 2023 | KPMG | No-logs assurance | Assurance on privacy-policy claims (ISAE 3000 report on internal controls) | Public report |
| Nov 2022 | Cure53 | Other | Second audit of the Lightway VPN protocol | Public report |
| Oct 2022 | Cure53 | App / client | Audit of the ExpressVPN browser extension | Public report |
| Sept 2022 | KPMG | No-logs assurance | Control testing of privacy-policy compliance on VPN servers, including no activity or connection logs and TrustedServer operating as described | Public report |
| Sept 2022 | Cure53 | App / client | Security audit of the iOS app | Public report |
| Aug 2022 | Cure53 | App / client | Security audit of the Android app | Public report |
| Aug 2022 | Cure53 | App / client | Audit of the Linux app | Public report |
| Jul 2022 | Cure53 | App / client | Audit of the macOS app | Public report |
| Jul 2022 | Cure53 | Other | Security audit of the Aircove router | Public report |
| May 2022 | Cure53 | Infrastructure | Penetration test and source-code audit of TrustedServer, the in-house VPN server technology | Public report |
| Apr 2022 | F-Secure | App / client | Audit of the Windows v12 app | Not stated |
| Mar 2022 | F-Secure | App / client | Security audit of the Windows v10 app | Public report |
| Aug 2021 | Cure53 | Other | Security audit of the Lightway VPN protocol | Public report |
| Jun 2020 | PwC | Other | Audit of the build verification process | Not stated |
| Jun 2019 | PwC | No-logs assurance | ISAE 3000 (Revised) audit of privacy-policy compliance and TrustedServer | Gated or summary only |
| Nov 2018 | Cure53 | App / client | Security audit of the browser extension | Public report |
Ownership
- 2024 A journalist reported unexpected DNS requests when split tunneling was used in the Windows app; ExpressVPN shipped a fix and commissioned a Nettitude retest, published April 2024.
- 2021 A government deferred-prosecution agreement named ExpressVPN's chief information officer over work for earlier employers; ExpressVPN published a statement the same day.
Security and features
- WireGuardYes
- RAM-only serversYes
- Full-disk encryptionUnknown
- Post-quantum optionYes
- Open-source appsUnknown
- Kill switchYes
- Split tunnellingYes
- Multi-hopUnknown
- Port forwardingNo
- IPv6Unknown
- WireGuard config exportUnknown
- SOCKS5 proxyUnknown
- Custom DNSUnknown
- Linux app (GUI)Yes
- Linux CLIYes
- Dedicated IPYes
Network Provider-reported
- ServersNot stated
- Countries113
Account and payment privacy
- Sign up without emailUnknown
- Account-number loginUnknown
- CashUnknown
- MoneroNo
- BitcoinNo
Our take
ExpressVPN's privacy case rests on evidence you can inspect. KPMG's public no-logs assurance engagement, dated 28 Feb 2025, examined TrustedServer and privacy-policy controls against activity and connection logging. This was point-in-time assurance, so it supports a bounded conclusion about the controls assessed, rather than a permanent guarantee. Cure53's public TrustedServer assessment, dated May 2022, adds penetration testing and source-code review. The Lightway and app audits broaden the security evidence, but their scopes differ from logging assurance. Read the audit list by scope, rather than treating every entry as another endorsement of the same privacy claim.
Express Technologies Ltd. is part of Kape Technologies, which also owns CyberGhost VPN, Private Internet Access, vpnMentor and Wizcase. Owning providers alongside review sites creates a commercial conflict you should consider when evaluating recommendations. It does not invalidate an auditor's work, but it makes the public reports more useful than brand endorsements. In 2021, a government deferred-prosecution agreement named ExpressVPN's chief information officer over work for earlier employers. ExpressVPN responded publicly. That history belongs in your trust assessment, while remaining distinct from evidence about the VPN's current technical controls.
Judge the subscription by its renewal rate and total cost, especially if you expect to keep using it. The longest Basic offer starts at €2.49 a month for 28 months, then renews at €6.66 a month. The plans table estimates a total cost of €123 for that option, compared with €468 for monthly Basic over the same comparison period. Start your comparison with Basic; choose Advanced or Express Pro only when their included extras justify the additional expense for your use.
For developers, the Linux GUI and CLI, kill switch and split tunnelling give ExpressVPN a practical role as a commercial VPN. Port forwarding is unavailable, so it is a poor fit when inbound connections are a requirement. Reaching your own machines also calls for a separate assessment of private access tools; our public versus private access guide explains that distinction. Alongside NordVPN, Proton VPN, Mullvad VPN or IVPN, assess ExpressVPN on audit scope, ownership and renewal cost. Its public assurance evidence is a reason to shortlist it, while the ownership conflict and port-forwarding limit may decide against it.
FAQ
What evidence supports ExpressVPN's no-logs claims?
KPMG's public no-logs assurance engagement, dated 28 Feb 2025, assessed TrustedServer and privacy-policy controls against activity and connection logging. It provides point-in-time assurance within that scope, rather than a guarantee of future behaviour.
Who owns ExpressVPN?
ExpressVPN is operated by Express Technologies Ltd., part of Kape Technologies. Kape also owns CyberGhost VPN, Private Internet Access, vpnMentor and Wizcase, so consider that commercial relationship when reading recommendations from those review sites.
Does ExpressVPN have a Linux app?
ExpressVPN offers both a Linux GUI and a CLI. That gives you a choice of desktop controls or terminal use, depending on how you manage your machine.
Can I use ExpressVPN for port forwarding?
ExpressVPN does not offer port forwarding. If you need inbound connections to a service behind the VPN, that requirement rules it out.
Does ExpressVPN cost more when it renews?
The longest Basic offer moves from €2.49 a month initially to €6.66 a month at renewal. Compare the renewal and total-cost columns before choosing a term; the refund window is 30 days.
What happened with ExpressVPN's Windows DNS issue?
In 2024, a journalist reported unexpected DNS requests when using split tunnelling in the Windows app. ExpressVPN shipped a fix and commissioned a Nettitude retest, with a public report dated Apr 2024. That retest addresses the specific remediation, rather than establishing that every app feature is free of defects.