ExpressVPN is a VPN app. Once it is connected, it encrypts everything your device sends and routes it through an ExpressVPN server, which fetches the page or file you asked for and sends it back through the same encrypted tunnel. Your internet provider and anyone sharing your Wi-Fi can see that you are talking to ExpressVPN, but not what you are doing. Websites see the server's IP address and location instead of yours. The details below come from ExpressVPN's own site, checked on November 4, 2026.

What happens when you press connect

The app picks a server location and a protocol, then opens an encrypted tunnel to that server. By default the protocol setting is Automatic, which ExpressVPN says usually means its own protocol, Lightway. ExpressVPN says Lightway often connects in a fraction of a second.

Once the tunnel is open, your device encrypts each packet before it leaves. The ExpressVPN server decrypts it, makes the request to the website, and encrypts the reply on the way back. The site never talks to your device directly, so it records the server's address.

Lightway, WireGuard and OpenVPN

A protocol is the set of rules the app and server use to build and run the tunnel. ExpressVPN offers three.

Lightway is ExpressVPN's own protocol and the default. It is built on the wolfSSL cryptography library, its core code is open source on GitHub, and ExpressVPN rewrote it in Rust. Cure53 reviewed Lightway in 2021 and 2022, and Cure53 and Praetorian audited the Rust version in 2024. It runs over UDP, which suits most networks, or TCP, which can get through networks that block UDP. On Windows, a Lightway Turbo option splits your traffic across several lanes to move more data at once.

WireGuard is available in the iOS, Android, Windows, macOS, Linux and Apple TV apps. ExpressVPN runs its own implementation, which it says adds privacy protections without changing the WireGuard protocol itself.

OpenVPN is the long-standing open-source option, also over UDP or TCP. It is the one to try if the other two will not connect on a particular network. When the setting is on Automatic, the app sometimes uses IKEv2 as well.

Both Lightway and ExpressVPN's WireGuard use post-quantum protection by default. They agree on session keys with ML-KEM, the method NIST chose as its standard for post-quantum encryption. The aim is that traffic recorded today cannot be decrypted later by a quantum computer. The traffic itself is protected with AES-256 encryption, according to ExpressVPN.

How ExpressVPN changes your IP address and location

Your internet provider gives your connection an IP address that points back to your home or phone network. With ExpressVPN on, every site sees the address of the server you picked, in one of 113 countries. Choose a server in Japan and you appear to be in Japan.

Most users share server addresses, which makes it harder to tell people apart. The trade-off is that some banks and shops send shared addresses through extra checks. The Express Pro plan includes a dedicated IP, which gives you the same address each time you connect to that server.

TrustedServer: servers that forget

ExpressVPN runs every server from RAM, with no hard drives that could store your data, and calls the setup TrustedServer. Each restart wipes all information on the server. PwC Switzerland audited TrustedServer. If someone seized or broke into a server, they would find very little on it, because nothing is written to disk.

Network Lock, the kill switch

If the tunnel drops, your device would normally carry on over your normal connection and expose your real address. ExpressVPN's kill switch, which it also calls Network Lock, uses firewall rules to block IPv4, IPv6 and DNS traffic until the tunnel is back, including when you move between networks.

How it behaves depends on the device:

  • On Windows, macOS and Linux it is on by default and allows traffic when you disconnect on purpose. Choose "Enable at all times" to block traffic then too.
  • On Android the in-app kill switch is on by default, and Android's own "Block connections without VPN" setting gives stricter blocking.
  • On iOS it is always on. The Advanced level blocks all traffic while the VPN is off, apart from essential Apple DNS requests.

Split tunneling

Split tunneling lets you send some apps or websites through the VPN and the rest over your normal connection. You might keep a work app or a local streaming service outside the tunnel while everything else goes through it. ExpressVPN supports this per app and per website on Windows, macOS and Linux, and per app on Android 7.0 and later. On iPhone it is limited to leaving out websites by single IPv4 address.

What ExpressVPN keeps

ExpressVPN says it does not log your activity and that independent firms audit that policy. Its about page lists audits by PwC, Cure53 and KPMG, and it has run a public bug bounty program since 2019. The company was founded in 2009, operates from the British Virgin Islands, which has no mandatory data retention laws for VPN providers, and joined Kape Technologies in 2021.

What a VPN does not do

The tunnel shifts trust from your internet provider to ExpressVPN, because its servers carry your traffic. Sites you sign in to still know who you are, and cookies can still follow you around the web. A VPN will not stop you from entering a password on a phishing page. ExpressVPN's apps include a tracker and malicious site blocker that catches some of these, though no blocker knows every bad site.

Streaming services and some governments also work to block VPN traffic. A server that reaches a service today may not tomorrow, and some countries restrict VPN use by law, so check local rules before you travel.

Plans, devices and refunds

On November 4, 2026, ExpressVPN had three consumer plans. Basic covers 10 devices at once, Advanced covers 12 and Express Pro covers 14. Advanced and Express Pro add Identity Defender tools for US subscribers, and Express Pro includes the dedicated IP. First-time users get a 30-day money-back guarantee. There are apps for Windows, macOS, Linux, iOS, Android, Apple TV, Fire TV and Android TV, browser extensions for Chrome, Firefox and Edge, and router support, including ExpressVPN's own Aircove routers.

Is ExpressVPN the right VPN for you

ExpressVPN suits people who care most about how the service is built: an audited in-house protocol, RAM-only servers and post-quantum key exchange switched on without any setup. If you would rather have more time to decide, CyberGhost gives 45 days on its longer plans. You can see the details on our ExpressVPN listing, or compare it with NordVPN and Surfshark.