ExpressVPN review
VPNVPN with RAM-only TrustedServer infrastructure and its own Lightway protocol; prioritises simplicity and speed over entry price.
- No-logs auditKPMG audited the no-logs policy and TrustedServer in 2022; Cure53 separately audited the TrustedServer code (2022) and the Lightway protocol (2021, 2022, and again together with Praetorian in 2024).
- JurisdictionBritish Virgin Islands: no legal data-retention obligation for VPN providers, according to ExpressVPN itself.
- Money-back window30 days
The $2.99/mo figure is the Basic plan (2 years + 4 months, billed $83.72, then $99.95/year), with 10 devices; the higher tiers rise to 14 and include a dedicated IP.
ExpressVPN is a commercial VPN service founded in 2009, built for people who want to encrypt their connection and change their virtual location without fiddling with technical settings: the app favours simplicity and speed over the granular controls some other providers offer to power users.
Its most distinctive feature is TrustedServer technology, which runs every server entirely on RAM and reinstalls the software stack on each reboot, so no data is ever written to a hard drive; KPMG audited the no-logs policy and the server technology itself in 2022, while Cure53 separately reviewed the TrustedServer source code and Lightway, ExpressVPN's own protocol, which the company rewrote in Rust and has since given post-quantum protection via ML-KEM. The company operates legally from the British Virgin Islands, a jurisdiction with no mandatory data-retention laws for VPN providers. Since December 2021, ExpressVPN has been part of Kape Technologies, the same group that has owned CyberGhost since 2017 and Private Internet Access since 2019 — three brands pitched against each other in VPN comparisons while sharing the same parent company.
The entry plan costs $2.99/month, billed as $83.72 for the first 28 months (2 years + 4 months), renewing annually afterwards at $99.95; it includes 10 simultaneous devices, rising to 14 on the higher tiers. The money-back guarantee runs for 30 days. Cryptocurrency payment, which ExpressVPN accepted in the past, does not appear among the checkout options today (card, PayPal, Apple Pay and Google Pay).
Features
- Countries
- 113
- Simultaneous devices
- 10
- No-logs audit
- KPMG audited the no-logs policy and TrustedServer in 2022; Cure53 separately audited the TrustedServer code (2022) and the Lightway protocol (2021, 2022, and again together with Praetorian in 2024).
- Jurisdiction
- British Virgin Islands: no legal data-retention obligation for VPN providers, according to ExpressVPN itself.
- Protocols
- Kill switch
- Split tunnelling
- Dedicated IP
- Pays with crypto
- Money-back window
- 30 days
ExpressVPN
From $2.99
On our blog
What it really means when a VPN says it is audited
"Audited" can mean three different things — the no-logs policy, the app's code, or the server infrastructure — and none of them tells you which country's law the company operates under. Nine VPNs from...
Alternatives to ExpressVPN
All providers
CyberGhost
Romania · 2011
Budget-priced Romanian VPN whose own site doesn't disclose its Kape Technologies ownership, though its no-logs policy is audited by Deloitte.
IVPN
Gibraltar · 2009
Gibraltar-based VPN with a deliberately small network (58 locations in 41 countries) and annual Cure53 audits since 2019.
Mullvad VPN
Sweden · 2009
Swedish VPN with a flat €5/month fee and fully anonymous accounts that require no email address.
NordVPN
Panama · 2012
Panama-based VPN with 8,000+ servers across 225 locations and a no-logs policy audited by independent firms.