ExpressVPN review (2026): three tiers, post-quantum Lightway and a high renewal price

What ExpressVPN is in 2026

ExpressVPN has sold a consumer VPN since 2009 and joined Kape Technologies in 2021. The service is run by Express Technologies Ltd. and registered in the British Virgin Islands, whose law governs its terms. If you last looked at it a few years ago, a fair amount has changed.

There are now three tiers instead of one plan. Basic, Advanced and Express Pro share the same VPN and servers but differ in how many devices you can connect (10, 12 or 14) and in the extras bundled on top: an AI chat service, email aliases, a password manager, a travel eSIM and, on Express Pro, a dedicated IP.

The technology underneath has moved on too. Lightway, ExpressVPN's own protocol, was rewritten in Rust, part of its code is open source, and it uses post-quantum encryption by default. The servers run entirely from RAM.

So has the price. The monthly plan used to be $12.95. It now starts at $14.99 for Basic and goes up to $22.99 for Express Pro, although the long plans bring the first term well below that.

Every price and feature below was checked on ExpressVPN's own site on November 4, 2026.

Signing up and getting connected

You can start in two ways, and the choice affects your refund rights.

If you buy on expressvpn.com, you pick a tier and a term, pay by card, PayPal, Apple Pay or Google Pay, then download the app for your device and sign in. Website purchases come with the 30-day money-back guarantee for first-time customers.

If you sign up inside the iOS or Android app, you get a 3-day free trial instead, billed through your App Store or Google Play account once it ends. Those in-app subscriptions are outside ExpressVPN's own guarantee, so refunds after that point are up to Apple or Google. For most people the website route is the better deal: 30 days to decide beats 3.

Once you are signed in, the app suggests a location (ExpressVPN calls this Smart Location) and you connect from the main screen. ExpressVPN recommends leaving the protocol on Automatic, which it says usually picks Lightway. You can sign in on your other devices with the same account, up to your plan's device limit, and the apps cover Windows, macOS, Linux, iOS, Android, Apple TV, Android TV and Fire TV, plus extensions for Chrome, Firefox and Edge.

ExpressVPN publishes setup guides for each platform, including PlayStation, Xbox and routers, so devices that cannot run the app still have a documented path.

Plans: Basic, Advanced and Express Pro

Every tier includes the full server network, Lightway, the kill switch, split tunneling and Advanced Protection, which blocks ads, trackers, malicious sites and adult sites. The differences sit around that core.

US subscribers on Advanced and Express Pro also get Identity Defender, which adds credit monitoring, data-broker removal and identity theft insurance. ExpressVPN lists it as a US-only feature.

If you only want a VPN, Basic is enough. Advanced makes sense if you were going to pay for a password manager anyway. Express Pro is mainly worth it if you need the dedicated IP, since adding one to a monthly Basic plan costs $8.99 a month on its own.

Lightway, post-quantum encryption and other protocols

Lightway is ExpressVPN's own protocol and the one the Automatic setting usually picks. It runs on the wolfSSL cryptography library, its core code is published on GitHub, and ExpressVPN rewrote it in Rust. Cure53 assessed it in 2021 and 2022, and after the rewrite Cure53 and Praetorian audited it again in 2024.

Lightway now uses ML-KEM, the post-quantum key exchange standard chosen by NIST, by default. That protects your traffic against someone who records it today and hopes to decrypt it later with a quantum computer. You do not have to switch anything on.

ExpressVPN says Lightway connects quickly and uses fewer system resources than older protocols. On Windows there is also Lightway Turbo, a speed option that ExpressVPN says is coming to other platforms.

WireGuard (on iOS, Android, Windows, macOS, Linux and Apple TV), OpenVPN and IKEv2 are still available if you prefer a standard protocol. On supported platforms the apps also switch on automatic obfuscation, which keeps the connection working on networks that block VPN traffic. If you need a VPN built around getting past heavy censorship, Astrill VPN is designed for that job.

Traffic is encrypted with AES-256, and the apps include IP, DNS and WebRTC leak protection, with each server running its own private DNS.

Servers and locations

ExpressVPN lists 214 server locations in 113 countries, including servers in all 50 US states. Its features page says the network uses 10Gbps and 40Gbps servers.

Some locations are virtual. A virtual location gives you an IP address registered to one country while the server itself sits in another. The server list marks them, and examples include the Bahamas, the Cayman Islands and Venezuela. India is a well-known case: ExpressVPN removed its physical servers there after a 2022 data law and now offers Indian IP addresses from virtual servers instead. For most uses a virtual location works the same, but if you need your traffic to physically stay in a country, check the list first.

You can also pin yourself to one IP with a dedicated IP, offered in 29 locations across 22 countries, including seven US cities. ExpressVPN issues it through blind tokens so the IP is not tied to your account in its systems. A fixed address is useful when a bank, company network or admin panel only accepts known IPs.

Privacy, logging and audits

ExpressVPN says it does not log your browsing history, where your traffic goes, the DNS queries you make or the IP addresses it assigns you. It does keep a short list of account data: which apps and versions you activated, the dates you connected (not the times), the location you chose (not the server IP), your source country and how much data you transferred in total. Diagnostics such as crash reports are optional and can be turned off in the apps.

The servers back that up with what ExpressVPN calls TrustedServer. Every server runs from RAM, and its software reloads from a read-only image each time it restarts, so nothing is written to a hard drive. PwC first audited TrustedServer, and Cure53 has reviewed it since. KPMG has also audited ExpressVPN's privacy claims, and the company says all reports are public.

Ownership still comes up in privacy discussions. Since 2021 ExpressVPN has been part of Kape Technologies, which it describes as a family of privacy and security brands, and some privacy buyers prefer a smaller independent company. What matters in practice is what the audits cover and how recent they are, so read the latest reports if this is your deciding factor.

ExpressVPN is registered in the British Virgin Islands, outside the US and EU, and says the territory has strong privacy laws. The RAM-only servers and the audits are still the stronger evidence.

Kill switch, split tunneling and blocking

The kill switch, which ExpressVPN now calls Internet Kill Switch, blocks unencrypted traffic whenever the VPN connection drops, so your real IP does not leak. It is on by default on Windows, macOS, Linux and Android. On Windows, macOS and Linux it lets traffic through when you disconnect on purpose, and you can set it to block at all times instead. On iOS it is always on, with a stricter Advanced level that blocks everything except essential Apple requests while the VPN is off.

Split tunneling lets chosen apps or sites bypass the VPN, which keeps your printer, NAS or smart-home hub reachable and lets a banking app see your normal connection. The options vary by platform:

• Windows 10 and 11 and macOS 11 or later: by app or by website, IP address or subnet
• Linux: by app, IP address or subnet
• Android 7 or later: by app
• iOS: by website only, using single IPv4 addresses

Advanced Protection covers the blocking tools. You can block trackers, malicious sites, ads (at the DNS level) and adult sites, and set parental controls by category. Tracker and malicious-site blocking work in the desktop and mobile apps and in the browser extension when it is paired with the desktop app. ExpressVPN is clear that tracker blocking does not stop cookies or browser fingerprinting, and that its malicious-site blocking does not replace antivirus software.

Routers, TVs and consoles

A router is the cleanest way to put a games console, smart TV or smart-home device behind a VPN, and ExpressVPN sells its own routers as well as supporting ones you already own.

Its newest router is Fortify, a Wi-Fi 6 model built with GL.iNet and sold for $199.99 with 12 months of the Advanced plan included. ExpressVPN says it handles up to 86 devices and VPN speeds of up to 900Mbps on WireGuard, with parental controls and a choice of which device uses which location. After the first year you renew the subscription as normal.

The older Aircove range is still on sale: Aircove for homes and small offices, and the pocket-sized Aircove Go for travel. Both have dual-band Wi-Fi 6 and ExpressVPN built in, with a top VPN speed of 330Mbps. You need an active subscription for the VPN, although the built-in protection features work without one. Dedicated IPs do not work on Aircove. We could not find a current Aircove price on ExpressVPN's site.

If you already own a compatible router, ExpressVPN's router app and setup guides are the alternative. Whichever route you take, every device on the router's network goes through the VPN without its own app.

The extras: ExpressAI, MailGuard, ExpressKeys and the MCP server

Much of the gap between the tiers comes from extras, so it is worth knowing what they are before you pay for them.

ExpressAI is a browser-based AI chat that ExpressVPN runs in secure computing enclaves. It says conversations are not stored long term or used for training, and Cure53 audited the design. Basic gets one model and 50 credits a day; Express Pro gets six models, including open models from OpenAI, Google, DeepSeek and Qwen, and 500 credits a day.

ExpressMailGuard gives you email aliases that forward to your real inbox, so you can hand out a different address to each shop or newsletter and switch one off when it starts attracting spam. Basic includes 10 shared aliases; Express Pro has unlimited aliases and up to 20 custom domains.

ExpressKeys is a password manager with zero-knowledge encryption, passkeys, autofill and a built-in two-factor code generator. It comes with Advanced and Express Pro or as a separate subscription.

The MCP server is the most unusual extra. It is a local, opt-in server in the desktop apps that lets AI coding tools such as Claude Code, Codex and Cursor check your connection, switch locations and run diagnostics. It is off by default, refuses remote connections and is available on the 1-year and 2-year plans.

Streaming and speed claims

ExpressVPN advertises stable HD and 4K streaming and quotes CNET praising its streaming, but its own site names no streaming services and says results vary by region, device and network. Apart from server capacity of 10Gbps and 40Gbps, it publishes no speed figures. We did not test streaming services or speeds for this review.

The practical advice is to use the refund window. Buy on the website, try the streaming services and locations you care about in the first 30 days, and ask for your money back if they do not work.

Pricing and value

ExpressVPN costs more than most of its big rivals, especially once the first term ends. These are the US dollar prices before tax on November 4, 2026:

The 2-year Basic plan is the value pick. At $83.72 for 28 months it costs less than a single year of Basic at the renewal rate. The jump comes afterwards: from month 29 you pay $99.95 a year unless you cancel or switch providers.

Monthly billing is expensive at $14.99 to $22.99, so it makes sense only for a short trip or a one-off need. The dedicated IP add-on is $8.99 a month on a monthly plan. ExpressVPN for Teams is priced by quote, and the Fortify router is $199.99 including a year of Advanced.

There is no free plan. The only free option is the 3-day trial in the mobile apps; the 30-day money-back guarantee on website purchases covers first-time customers and refunds the full amount. If a renewal surprises you, ExpressVPN also gives 14 days from the renewal date to ask for a full refund.

Support

Support is available around the clock by live chat, with email at [email protected] as the other channel. The help center has setup guides for desktop, mobile, routers, consoles and TVs, plus troubleshooting articles for connection problems.

Refunds go through the same channels: you ask support by chat or email, and the guarantee page says the full amount goes back to your original payment method. We did not test response times for this update.

ExpressVPN vs Surfshark

Surfshark is the better pick if you count devices or dollars. It sets no device limit, and its 2-year plan costs $67.23 for the first 27 months ($2.49 a month), renewing at $79 a year for Starter, against ExpressVPN's $83.72 and $99.95 for Basic. Surfshark also offers a 7-day free trial on its longer plans.

ExpressVPN is the better pick if you want its own Lightway protocol, a dedicated IP bundled into Express Pro, and its own routers for the devices that cannot run an app. Both offer 30 days to ask for a refund on a website purchase.

ExpressVPN vs Private Internet Access

Private Internet Access is the cheaper long-term choice. It allows unlimited devices, its apps are open source, and its 1-year plan is $47.88 and renews at the same price, less than half of ExpressVPN's Basic renewal. The trade-offs are that PIA is based in the US, which some privacy buyers avoid, and it has more settings to work through.

Choose ExpressVPN if you want its own router hardware, the Lightway protocol and extras such as the password manager or a dedicated IP bundled into the plan. Choose PIA if you want to cover every device for less and do not mind adjusting settings.

Pricing and value

ExpressVPN has three tiers. Monthly prices are $14.99 (Basic, 10 devices), $16.99 (Advanced, 12 devices) and $22.99 (Express Pro, 14 devices). The 1-year plans cost $74.85, $89.85 and $134.85 for the first 15 months, and the 2-year plans $83.72, $117.32 and $201.32 for the first 28 months, which brings Basic down to about $2.99 a month. After the first term, the longer plans renew at $99.95, $119.95 or $199.95 a year. There is no free plan; the mobile apps offer a 3-day free trial, and website purchases carry a 30-day money-back guarantee for first-time customers. Prices in US dollars before tax, checked November 4, 2026.

Who should buy it

Buy ExpressVPN if you want a VPN that works on everything in the house with very little setup, including consoles and TVs through one of its routers. It suits people who value audited privacy claims and post-quantum encryption that is on by default, and people who need a dedicated IP for work logins. The 2-year Basic plan is the best value if you are happy with 10 devices.

Who should skip it

Skip ExpressVPN if you need more than 14 devices on one account or care most about the price after the first term; Surfshark and Private Internet Access both allow unlimited devices for less. Skip it if you want a free VPN for light use, where Windscribe has a free plan, or if you live behind heavy censorship and need a service built around stealth protocols, such as Astrill VPN.