ExpressVPN review (2026): A stylish VPN service with proven privacy

Founded in 2009, ExpressVPN is one of the biggest names in the online privacy space. Does it deserve the prestige?

When I first reviewed ExpressVPN back in 2023, I was impressed with its strong privacy practices and stylish app, but took issue with its expensive subscriptions and ownership. In the years since, ExpressVPN has continued to grow its global server network, overhauled its desktop apps, added a neat ShuffleIP feature, and reworked its plans with new tiers and more simultaneous connections. As of early February, it’s added new non-VPN privacy tools to most of its plans at no extra cost, with more in the works.

I’ve been busy, too. Last year, I came up with an all-new VPN reviewing methodology for Mashable that involves more rigorous criteria and a standardized scoring rubric. Consider this a from-scratch review redo.

So, to return to the question at hand: Is ExpressVPN any good in 2026? For this ExpressVPN review, I spent nearly two weeks re-testing and re-evaluating its service. I walked away more impressed with it than before.

ExpressVPN review: How much does it cost?

ExpressVPN offers the following plans as of February 2026:

• The Basic plan comes with 10 simultaneous connections, a built-in speed test, an ad blocker, a malicious site blocker, and limited access to two new digital privacy tools (ExpressMailGuard and ExpressAI). Prices range from $3.49 per month for 28 months to $12.99 on a monthly basis.

• The Advanced Plan adds two extra simultaneous connections, a tracker blocker, an adult site blocker, an eSIM with three days of unlimited data, more access to ExpressMailGuard and ExpressAI, and full access to ExpressKeys and Identify Defender. Prices range from $4.49/month for 28 months to $13.99 monthly.

• The Pro Plan includes 14 simultaneous connections, a dedicated IP address, an eSIM with five days of unlimited data, and full access to all of the aforementioned privacy tools. Prices range from $7.49/month for 28 months to $19.99 monthly.

For the purposes of this review, I only tested the VPN service itself.

All things considered, ExpressVPN plans are a pretty decent value, more so if you opt for an annual or biannual plan. (Just be aware that they both renew as pricier yearly plans after your first term.) ExpressVPN’s monthly rates aren’t the most expensive I’ve seen, but they’re also not the cheapest.

I would probably pick the Advanced plan over its Basic plan, which gets you way more extra fixings for just $1 more per month — or less when ExpressVPN runs sales, which is often. For new users, all ExpressVPN subscriptions are covered by a 30-day money-back guarantee.

At present, you can pay for an ExpressVPN subscription with a credit card, Apple Pay, PayPal, or Google Pay. It used to accept Bitcoin and cryptocurrencies, but those options weren’t available at the time of writing. An ExpressVPN representative told me they’re temporarily disabled because of technical issues in certain areas. They should be back soon.

In September 2025, ExpressVPN introduced a free VPN service called EventVPN. It doesn’t have any data or time limits, but it makes you watch ads every time you start a new session. I’ll test it at a later date; this review only covers ExpressVPN’s flagship paid service. 

Is ExpressVPN trustworthy?

ExpressVPN abides by a strong privacy policy, which it audits regularly alongside its features and apps. Additionally, its no-log policy has been verified by numerous transparency reports and as part of a criminal investigation. However, I think certain users will side-eye it for a couple of reasons.

ExpressVPN privacy policy

ExpressVPN’s privacy policy is a little jargon-y, but it thoroughly explains what kind of data it does and doesn’t collect. The information it does retain includes account information (such as email addresses and payment information), usage statistics, and anonymous app diagnostics that users can opt into (such as crash reports). It also collects data for marketing purposes when you use its app, but promises that “[this] data cannot be linked to the online activity of any particular person.”

The company explains why it collects this data, emphasizing a “guiding principle” of only saving “the minimal data required” to operate its services. It also specifies that the data isn’t sold or leased to third parties, nor managed by ExpressVPN’s parent company, Kape Technologies. (More on Kape momentarily.) This is all standard for a major paid VPN provider.

ExpressVPN says it retains the aforementioned user data “for a limited period in accordance with applicable data protection law (for as long as we have your consent or a legitimate reason for holding such data).” You can submit a data deletion request, though you won’t be able to use ExpressVPN afterward.

Credit: ExpressVPN

Third-party providers like payment processors (i.e. PayPal) may get access to some user data if you use their services via ExpressVPN. The company says they’re subject to “confidentiality and data processing obligations” and that they can’t use this data for any other purpose.

ExpressVPN doesn’t log any sensitive user data like browser history, DNS queries, or traffic connection logs, including IP addresses or session durations. Since it doesn’t collect this data, it can’t store it or turn it over to authorities, even if they were to request it. 

The policy notes that ExpressVPN’s servers are housed in secure data centers that don’t mandate sensitive data collection — and that if they ever reversed course, ExpressVPN would stop using them. “Even if a government were to physically seize one of our VPN servers,” its privacy policy reads, “there would be no logs or information that would tie any individual user to a particular event, website, or behavior.” 

This held up in 2017 when Turkish authorities seized an ExpressVPN server in an attempt to find logs in connection with an investigation, and came up empty, the company said.

Furthermore, ExpressVPN shut down its servers in India in 2022 after the country introduced a new data law requiring all VPN providers to store users’ real names and usage patterns (among other identifying data) for at least five years.

ExpressVPN transparency reports

ExpressVPN’s biannual transparency reports also back up its no-log claims. These reports peel back the curtain on any legal requests the company receives.

Per its latest transparency report, ExpressVPN received 374 formal requests from government, law enforcement, or civil entities from January to June 2025, more than double the volume of the previous report cycle. It also received 1,063,598 DMCA requests. ExpressVPN says it didn’t disclose any user data in response to these requests, which is exactly what I want to hear.

Credit: ExpressVPN

ExpressVPN has only been publishing transparency reports since 2024, but so far, all of its findings have been the same.

ExpressVPN audits

Regular independent audits are another way VPN providers can prove that they don’t have anything to hide. ExpressVPN considers such audits “a central pillar of our commitment to users,” and it shows. 

The company has commissioned more external audits than any other provider in the industry, it claims, including nearly 20 since 2022. These include assessments of its privacy policy, server technology, Lightway protocol, browser extension, mobile apps, desktop apps, and Aircove routers. 

Most of these audits are redone every two years, but a couple of them have gone unupdated since 2022. It would be nice if ExpressVPN got on a more frequent auditing schedule. Still, this is another respectable degree of transparency. Plus, anyone can read the results without needing to make an ExpressVPN account.

ExpressVPN supplements its audits with a bug bounty program, which encourages security researchers to hunt for vulnerabilities in its apps. It has offered this program since 2020 and upped its bonus award to $100,000 in 2022. It’s still unclaimed.

ExpressVPN DNS leak incident

In February 2024, CNET’s Attila Tomaschek noticed that ExpressVPN’s split tunneling tool was leaking DNS requests on Windows. (Disclosure: Mashable and CNET are both owned by the same parent company, Ziff Davis.) Some user traffic was being routed through third-party servers instead of ExpressVPN’s servers, exposing it to the public internet. This bug had been around for nearly two years before it was discovered, according to Bleeping Computer.

This is exactly what you don’t want to happen when you use a VPN. (Fortunately, the bug affected less than one percent of users on Windows.) But providers’ reactions to issues like this are important measures of their commitments to transparency, or lack thereof. A good response is key to rebuilding consumer trust, and a bad one will erode it even further.

For its part, I think ExpressVPN’s response was good; it certainly did its due diligence. After learning about the issue, the company immediately disabled its split tunneling tool on Windows while its engineering team looked into the bug, and it informed its user base about the problem via blog post. It then updated its Windows app with a fix and commissioned an external audit that verified its security. On top of that, it conducted further research into DNS leak testing methods and published a technical paper on its findings.

ExpressVPN ownership and leadership

Credit: ExpressVPN

ExpressVPN is owned by a British-Israeli digital security company called Kape Technologies that has a less-than-sterling reputation among some folks in the cybersecurity realm. I’m generally of the opinion that any sort of corporate sketchiness is a good reason to abandon a VPN service, but in the case of Kape, I don’t think we should dismiss ExpressVPN entirely. That said, I would approach it with more skepticism than providers with different ownership.

Kape was once a development platform for browser extensions called Crossrider, which some third-party app developers allegedly used for adware injection. A joint study between Google and the University of California, Berkeley in 2015 flagged Crossrider as part of a “network of affiliates” that drove and made money off clicks to injected ads. The Crossrider extensions platform was shut down in 2016. In 2018, the company rebranded to Kape Technologies. It acquired ExpressVPN three years later.

Per a media handout, Kape maintains that Crossrider itself wasn’t an adware distributor, only that its products were abused by “a small subset” of the developers and publishers using its technology.

“Due to how the Crossrider platform worked, extensions by developers using the platform were typically linked to Crossrider in one way or another (signing, distribution, etc.),” the handout reads. “This had the unfortunate effect of some of these extensions being misattributed to Crossrider itself, including by adware and malware scanning and removal tools.”

The handout goes on to note that Crossrider had a connection to a third-party ad marketplace so developers could monetize their extensions, and that it received a portion of their revenue. However, it adds, developers controlled “where and how ads were served through their extension.”

Kape’s ancestry might give some users pause. You don’t want a company in the business of cybersecurity to show any signs of shadiness, past or present. But to be clear, there’s no reason to believe that Kape is a bad actor with nefarious intentions in its current iteration. Furthermore, ExpressVPN operates separately from other Kape brands, and according to its audited privacy policy, Kape doesn’t control or store any of its user data. I was also able to confirm with ExpressVPN’s rep that the company generates all of its revenue from subscriptions.

Journalists, activists, and those who need a VPN to hide their identity in legally precarious or life-or-death situations might be inclined to take a “better safe than sorry” approach and defer to a different provider. I can’t fault you for that. But casual, everyday users for whom the stakes aren’t as high can be much less persnickety.

Right now, I’m more icked out by the fact that Kape has its fingers in multiple pies within the VPN space. Its portfolio includes ExpressVPN, Private Internet Access (PIA), and CyberGhost VPN, as well as Webselenese, a platform for the security tool review sites vpnMentor and WizCase. CNET reported that PIA and CyberGhost replaced two of the Webselenese sites’ top VPN picks shortly after Kape purchased them.

In a statement, Kape told me that the Webselenese sites “have and continue to be editorially independent from any of the privacy product brands within the Kape portfolio” since it acquired them. Additionally, it said, “[the] review sites owned by Webselenese maintain strict and transparent review standards, which are clearly outlined in their review methodologies and site disclosures.”

I still think this is a yucky conflict of interest, so look elsewhere for unbiased VPN reviews. Might I suggest Mashable dot com?

I want to mention one other incident that happened in 2021. The same week Kape announced that it bought ExpressVPN, the latter’s then-CIO Daniel Gericke was one of three former U.S. intelligence operatives who, under a deal to avoid prosecution, admitted to violating U.S. hacking laws as cyberspies for the United Arab Emirates as part of a secret surveillance program called “Project Raven.” Gericke was fined $335,000 and agreed to cooperate with the FBI.

In a subsequent blog post, ExpressVPN said it knew “key facts relating to Daniel’s employment history” before hiring him in 2019. “In fact,” the company added, “it was his history and expertise that made him an invaluable hire for our mission to protect users’ privacy and security.” Reuters reported that ExpressVPN’s initial positioning “disturbed” some of its employees. 

A day later, the company issued an expanded statement clarifying that it didn’t condone Project Raven or know of the investigation beforehand, while defending Gericke’s expertise. “Someone steeped and seasoned in offense, as Daniel is, can offer insights into defense that are difficult, if not impossible, to come by elsewhere,” it wrote. It went on to explain how its systems are protected from internal threats, and pledged to increase the regularity of its third-party audits to verify its privacy policy. Gericke continued to work for ExpressVPN until 2023.

I can see why people would be freaked out by this, but it is true that former hackers can be valuable assets for tech companies, so this isn’t a flaming red flag. But again, I won’t knock users for feeling differently based on their use cases.

Hands-on with ExpressVPN

Credit: ExpressVPN

ExpressVPN has apps for Windows, macOS, Android, iOS/iPadOS, Linux, Apple TV, and Fire TV/Fire TV Sticks, plus browser extensions for Chrome, Firefox, Safari, Edge, and Brave. It also sells VPN-enabled WiFi 6 routers called the Aircove and the Aircove Go. For the purposes of this review, I tested ExpressVPN on macOS for about a week and a half.

Most of the time, I completely forgot that ExpressVPN was running. It only took a few seconds to make an initial connection or switch servers. It passed several DNS leak tests, proving the VPN was consistently concealing my real IP address. It uses strong AES 256-bit and ChaCha20 encryption.

I spent most of my testing period on servers selected by ExpressVPN’s “Smart Location” feature. It uses an algorithm to find the fastest servers near you based on real-time factors like latency and geographical distance. (VPN servers that are physically closer to you are usually speedier than farther ones.) 

Browsing with ExpressVPN active never felt sluggish in practice, and a couple of back-to-back speed tests proved that it had a minimal impact on my internet speed. One of my usual Smart Locations was only five percent slower than my regular, non-VPNed internet connection. A server abroad (UK – London) was just 11 percent slower, which is great considering my traffic was traveling across a whole ocean.

Credit: Ookla / Mashable composite

I only ran into one access issue when I had ExpressVPN running: Archive.today wouldn’t load no matter what server I was on. This wasn’t detrimental to my daily workflow, though.

ExpressVPN app design

The ExpressVPN app has an attractive Corporate Memphis design that’s uncluttered and easy to navigate. Its main interface involves a central connection button, a clean map, and a session timer for the week. The map displays the location of your current server (plus its IP address). You can see the latency of nearby servers and click on them to change locations.

Credit: ExpressVPN

There’s a button near the top of the main menu that pulls up your full server list, which you can search by city or country. You can favorite servers and see recent locations you’ve been connected to.

Another button lets you choose which protocol you use. You can pick from OpenVPN, IKEv2, Wireguard, or ExpressVPN’s in-house, open-source Lightway protocol, which it touts as the fastest and most secure option. You can also set your protocol to “Automatic,” where the app chooses the best option for your network. (ExpressVPN says it’s usually Lightway.) This setting is on by default, and I used it throughout my testing.

Credit: ExpressVPN

A group of tabs on the left-hand side of the ExpressVPN interface pulls up a built-in speed test tool, an add-ons menu, your profile, a help section, and a QR code that you can scan with your phone to download the ExpressVPN mobile app. 

You can enable any non-VPN features that come with your plan via the add-ons tab. Your profile tab is where all your other settings live, including your kill switch (“Network Lock”) and a split tunneling tool that lets you pick which apps and websites get routed through the VPN.

ExpressVPN server network

Credit: ExpressVPN

ExpressVPN offers city-level server selection. At the time of writing, it had more than 3,000 servers across 108 countries. That’s a good amount of geographic diversity, though its network is much smaller than most of its competitors’ stables. ProtonVPN currently has over 17,800 server locations in 129 countries, and NordVPN has more than 7,400 servers in 118 countries. Tunnelbear has over 8,000 servers, but they’re only located in 47 countries.

Notably, ExpressVPN has servers in all 50 states. Other major VPN providers only have servers in select U.S. cities. This makes it an especially good option for frequent travelers who need to access content back home, and for those looking to skirt content restrictions in certain states. Think regional sports broadcasts (… and PornHub). A server in a neighboring area will be more reliable than a far-flung server across the country.

ExpressVPN features and support

As briefly mentioned, ExpressVPN has a kill switch that disables your internet connection if the VPN ever fails. This is available on all platforms. It also has a split-tunneling tool that lets you choose which traffic is routed through the VPN, available on all platforms except iOS. These are two of the three most important features I look for in a VPN.

Credit: ExpressVPN

The other is multi-hop, a feature that lets you route your traffic through two servers for an extra layer of protection. This is a premium feature offered by ProtonVPN, NordVPN, and Surfshark that’s especially useful for journalists and activists, but you won’t find it on ExpressVPN. In a blog post, the company said it “has intentionally chosen not to” offer multi-hop because its servers are secure and reliable enough on their own.

ExpressVPN’s ShuffleIP feature helps its case here. This relatively new tool automatically changes your IP address every time you visit a new website, without interrupting your connection. This makes it more difficult for anyone to track your activity. Surfshark offers a similar “rotating IP address” feature, but it’s only available on macOS and not on by default.

If you ever run into issues with ExpressVPN, you can submit a support request via the app’s help tab or use the 24/7 live chat feature on its website. It starts as an AI assistant, but you can get connected with a real agent in a couple of clicks.

ExpressVPN used to have a robust online support center, but many of its articles were broken at the time of writing. When I clicked on each of the 10 most popular articles featured on its landing page, six took me to error pages.

Can ExpressVPN unblock streaming services?

Unblocking georestricted streaming services isn’t the main point of using a VPN, but I still test for it because it’s important to many Mashable readers. I’m happy to report that ExpressVPN successfully unblocked ITVX, BBC iPlayer, and Netflix’s UK library while connected to a server in London.

Is ExpressVPN worth it?

ExpressVPN is a dependable and thoughtfully designed VPN for everyday browsing and streaming. Most importantly, its strong privacy practices have stood up to regular scrutiny, and it has a track record of thorough transparency. 

ExpressVPN’s new tiered pricing structure and suite of bonus privacy tools make it a better value than before, especially if you’re fine with committing to a longer-term plan. (Again, be mindful of the renewal markup.) Its global network isn’t very large, but its presence in all U.S. states makes it a solid choice for jet-setting professionals and users looking to skirt local georestrictions. If you’re on a plan that includes an eSim, it’s an excellent option for travel.

In terms of actual VPN features, power users will find that other providers still offer a little more for the money, like multi-hop connections and Tor network access. Don’t sleep on ShuffleIP, though.

Overall, I think ExpressVPN is a worth-it pick for casual users, especially those who regularly go abroad, though it’s not the absolute best VPN I’ve tried. The Mashable Choice Award-winning ProtonVPN is still the service I prefer for its larger global network, open-source apps, advanced VPN features, and loud commitment to online freedom causes.

UPDATE: Feb. 14, 2026, 5:14 a.m. EST Mashable originally published an ExpressVPN review in 2023. We’ve written this new review based on our updated VPN testing methodology and the latest ExpressVPN features.