ExpressVPN now sells three tiers with different products in each. Here are the six features that justify the price, and exactly which plan you need to get each one.
ExpressVPN is the expensive option, and it has spent years justifying that with engineering rather than feature counts: its own protocol, a server architecture that cannot retain data between reboots, and a habit of paying auditors to check the claims. If you buy a VPN on trust rather than on price, this is the shortlist it belongs on.
What has changed is the shape of the product. ExpressVPN now sells three tiers — Basic, Advanced and Express Pro — and they differ by more than device counts, bundling a password manager, email protection and a private AI chat service at different levels. This guide covers the six features worth having and which tier each one requires.
Affiliate disclosure: Reviews Lounge earns a commission when you buy through links on this page, at no additional cost to you. Commissions never influence our rankings, scores or recommendations. Full disclosure.
These three are the features that justify the price difference against cheaper providers.
ExpressVPN’s own protocol: a small, auditable codebase that connects fast, survives network switching and supports post-quantum protection, with an optional Turbo mode. Included on every plan tier.
Every server runs entirely in volatile memory and is wiped on each reboot, so there is no disk for activity data to persist on in the first place.
DNS-level blocking of adverts, trackers, malicious sites and adult content, plus parental controls that apply across every device on the connection, including televisions and consoles that cannot run an extension.
Every option side by side, with the one thing that actually distinguishes it.
| Feature | Best for | Where you get it | Key strength | Watch out for | |
|---|---|---|---|---|---|
| 1Lightway Protocol | Everyday use on any device | Protocol | Fast, auditable and battery-friendly | Proprietary; IKEv2 limited to Apple | View |
| 2TrustedServer | Privacy-first users | Server architecture | Logging is architecturally impossible | Still requires trust in the operator | View |
| 3Advanced Protection | Households and shared devices | DNS filtering | Protects devices that cannot run extensions | Domain-level only; off by default | View |
| 4ExpressKeys | Replacing a password manager | Password manager | Authenticator and passkeys included | Requires Advanced tier or above | View |
| 5ExpressMailGuard | Protecting your real address | Email aliasing | Pinpoints which service leaked you | Tight limits on the entry tier | View |
| 6ExpressAI | Confidential AI work | Private AI chat | Audited enclave-based confidentiality | Express Pro only; capable not frontier models | View |
← swipe the table to see all columns →
Three things, none of which is the marketing.
ExpressVPN has commissioned independent assessments from PricewaterhouseCoopers and from the security specialist Cure53, covering its privacy claims and its software. Audits are not proof of perfection, but a provider that repeatedly invites scrutiny from firms with their own reputational exposure is making a verifiable commitment rather than a marketing claim.
TrustedServer runs the entire server stack in volatile memory. Nothing is written to a hard disk, and every reboot wipes the machine and reloads a known-good software image. That makes a no-logs policy an engineering property rather than a promise, and it also eliminates configuration drift across the network.
Lightway is ExpressVPN’s own protocol, written with a deliberately small codebase so it can be audited properly, and it supports modern cryptography including ChaCha20 and post-quantum protection. It connects quickly, survives moving between Wi-Fi and mobile data, and uses less battery than heavier alternatives.
Three decisions, and the tier question is the one people get wrong.
The three tiers, Basic, Advanced and Express Pro, allow 10, 12 and 14 simultaneous connections respectively, and almost nobody should decide on that basis. The real differences are the bundled products: ExpressKeys, the password manager, is included with Advanced and Express Pro; ExpressMailGuard starts at Basic with more capability higher up; and ExpressAI, the private AI chat service, is Express Pro only. Price those products as standalone subscriptions and the tier choice answers itself.
Lightway is the right default on every platform and has a Turbo mode for additional throughput. OpenVPN remains available where you need maximum compatibility, and IKEv2 is offered on iOS and macOS only. Encryption is AES-256 with perfect forward secrecy, so session keys do not compromise past traffic. Then turn on the Internet Kill Switch, which ExpressVPN also calls Network Lock: if the tunnel drops it blocks all traffic until protection is restored, which is the difference between a brief interruption and a silent leak.
Two gaps matter. There is no port forwarding and no SOCKS5 proxy, so if a specific download or self-hosting workflow depends on either, this is the wrong provider and no tier fixes it. Torrenting itself is supported on all servers. The other gap is geographic: the identity-protection extras; credit monitoring, ID theft insurance, data removal – are restricted to United States subscriptions, so a UK buyer should discount them entirely when comparing tiers. Every plan carries a 30-day money-back guarantee, so test your own use case inside it.
Enable the kill switch, confirm Lightway is selected, and check that threat protection is switched on, the blocking of ads, trackers and malicious sites is off by default for some users. The built-in speed test is actually useful for finding a good server rather than guessing from the map.
Obfuscation runs automatically on supported platforms rather than being a mode you choose, which is why ExpressVPN tends to keep working on hotel and campus networks that block VPNs. Private, zero-knowledge DNS runs on every server, so DNS queries stay inside the tunnel rather than going to a third party.
A substantial part of the comparison table on higher tiers is United States only. Identity Defender, credit scanning, ID theft insurance underwritten by a US insurer, SSN monitoring, change-of-address alerts, court record monitoring: is not available on a UK subscription. Those rows should play no part in a UK tier decision.
What does travel well: the VPN itself, Lightway, TrustedServer, the blocking features, ExpressKeys, ExpressMailGuard and ExpressAI. Judge the tiers on those and the premium becomes much easier to assess.
Ranked by how well each one delivers on what it promises: not by price.
A small codebase is a security feature, not a shortcut, there is simply less of it for anyone to find a flaw in.
Lightway is the feature that most justifies ExpressVPN’s price, and it is available on every tier. It is a protocol ExpressVPN wrote rather than adopted, built around a deliberately minimal codebase on the principle that less code means fewer places for vulnerabilities to hide and a realistic prospect of proper independent review. In daily use the benefits are mundane and welcome: connections establish almost immediately, the tunnel survives moving between Wi-Fi and mobile data without manual reconnection, and battery consumption on phones is noticeably lower than with the heavier legacy protocols.
On cryptography it is current rather than conservative. The platform encrypts with AES-256 and perfect forward secrecy, so compromising one session key does not expose earlier traffic, and Lightway additionally supports ChaCha20 and post-quantum protection against the prospect of future decryption of today’s captured data. A Turbo mode is available where you want more throughput. OpenVPN remains selectable for maximum compatibility, and IKEv2 is offered on iOS and macOS only, which is worth knowing before you plan around it on Windows or Android. For almost everyone the right answer is to leave Lightway selected and never open the protocol menu again.
We may earn a commission from this link, at no extra cost to you.
A no-logs policy you have to believe is worth less than an architecture where logging was never possible.
TrustedServer is ExpressVPN’s server architecture and the strongest answer it has to the question every VPN provider struggles with: why should anyone believe the no-logs claim? The answer here is structural. Servers run the entire software stack in RAM, nothing is written to a hard disk, and every reboot wipes the machine completely and reloads a verified software image. Browsing activity and connection logs are not stored because there is nowhere persistent for them to be stored, and a server seized or compromised after a reboot holds nothing from before it.
The secondary benefit is consistency. Because each reboot loads the same known-good image, the network cannot accumulate the configuration drift that eventually afflicts long-running fleets, and outdated software on a forgotten machine stops being a plausible failure mode. Supporting this is ExpressVPN’s legal base in the British Virgin Islands, outside the main intelligence-sharing arrangements, and a pattern of independent assessment by PricewaterhouseCoopers and Cure53. Each server also runs ExpressVPN’s own zero-knowledge DNS, so queries stay in the tunnel rather than reaching a third-party resolver. Obfuscation is applied automatically on supported platforms as well, which is why the network tends to keep working on restrictive hotel and campus connections.
We may earn a commission from this link, at no extra cost to you.
Filtering at the DNS layer means it works on the smart TV and the games console, where a browser extension never could.
ExpressVPN’s protection suite blocks at the DNS layer, which is why it reaches places a browser extension cannot. The ad blocker stops advertising domains resolving at all, so the elements never load and pages are lighter as a result. A tracker blocker prevents apps and sites contacting third-party analytics and profiling services, and a malicious-site blocker stops the device connecting to known phishing and scam domains, with the blocklist maintained on ExpressVPN’s side rather than yours. All of it operates per-connection, so a television, console or smart speaker behind the VPN is covered.
Parental controls sit in the same system and filter adult or unsafe content by category across connected devices, which is far more practical than configuring every device individually. The caveats are the standard ones for DNS filtering. It cannot inspect encrypted content, so it blocks by domain rather than by what is on a page; occasional false positives will break something you wanted; and category-based adult filtering is approximate by nature. Some of this is off by default, so go and check the settings yourself rather than assuming it is already running.
We may earn a commission from this link, at no extra cost to you.
The password manager is the bundled extra most likely to replace something you already pay for every year.
ExpressKeys is ExpressVPN’s password manager, delivered as a standalone application rather than buried in the VPN client. It stores and generates unlimited passwords, includes a built-in two-factor authenticator so your codes and credentials live in one vault, supports passkeys for sites that have moved beyond passwords, and holds payment cards and secure notes. A password health view flags weak and reused credentials, which is the feature most people actually need and most people do not have. Higher tiers add file attachments to vault items, item sharing and larger storage allowances.
On availability, it is included with Advanced and Express Pro subscriptions, and is also sold as a standalone subscription through its Android, iOS and macOS apps. That makes it the clearest financial argument for stepping up a tier: if you currently pay for a password manager separately, the Advanced tier may well cost less than the two subscriptions combined. Be realistic about the comparison, though; the dedicated specialists have deeper enterprise features, richer sharing models and longer track records, and migrating a mature vault between managers is never as painless as the import dialogue suggests.
We may earn a commission from this link, at no extra cost to you.
An alias you can switch off is the only unsubscribe link that has ever reliably worked.
ExpressMailGuard protects your inbox by putting aliases between you and the services you sign up to. Instead of giving a retailer your real address, you give it a generated alias that forwards to you; when the retailer sells your details or suffers a breach, you disable that single alias and the problem stops at the boundary. Because each site gets its own address, you also learn exactly who leaked your details, which is information no amount of spam filtering can give you. The system supports alias domains, dedicated subdomains, forwarding rules, automatic alias creation and your own custom domains higher up the range.
It is available starting on the Basic tier, with additional capability on Advanced and Express Pro, and the allowances are tiered, the number of alias domains, dedicated subdomains, shared aliases, recipients, rules and daily anonymous sends all increase as you move up, and bandwidth is capped on the lower tiers before becoming unlimited at the top. Check those numbers against how you would actually use it, because the gap between tiers here is larger than the device-count difference that gets all the attention. Aliasing also adds a forwarding hop, so expect occasional deliverability quirks with strict corporate mail systems.
We may earn a commission from this link, at no extra cost to you.
The point is not that the models are the best available – it is that the conversation is not stored, read or trained on.
ExpressAI is the most unusual thing in ExpressVPN’s range: a private AI chat service accessed directly in the browser with no app, extension or download. Conversations are processed inside secure computing enclaves, isolated in a protected hardware environment with end-to-end encryption, held in encrypted memory and not retained long term. ExpressVPN states that neither the host server, nor ExpressVPN itself, nor any third party can access the contents, that conversations are not used for training, and that you can set chats to expire automatically. Its privacy and security design has been independently audited by Cure53, which is the detail that separates it from a marketing claim.
You get a selection of leading open models to choose between, covering general writing and reasoning, multi-step analysis, coding and multimodal work on documents, images and video, with file upload and storage allowances attached. Two honest limitations. It is restricted to Express Pro, the top tier, so you cannot try it cheaply. And the models available, while capable, are not the frontier commercial systems people compare against; the trade you are making is a step down in raw capability for a genuine step up in confidentiality, which is the right trade for sensitive work and the wrong one for everything else.
We may earn a commission from this link, at no extra cost to you.
We assess products on construction and claims we can verify — not on which brand pays most.
We test marketing claims against the actual published construction and specification, rather than taking a product name at face value.
Every product in a guide is judged against its siblings, so the ranking reflects what you actually choose between.
Independent certification, materials and build quality all feed into the score, not just headline features.
A score means nothing without context, so every pick states who it suits, and who should skip it.
We weigh what's included and what isn't, because delivery, fees and accessories change the real price.
Brands cannot buy a position. Affiliate commissions fund the site but never determine the order or the wording.
It depends entirely on what you are buying. If you want the cheapest competent VPN, no – several rivals do the core job for less, and some allow unlimited devices while ExpressVPN caps connections by tier.
If you are buying on trust, the case is stronger. A British Virgin Islands base outside the main intelligence-sharing arrangements, servers that run from RAM and retain nothing between reboots, a protocol written to be audited, and repeated independent assessments by PricewaterhouseCoopers and Cure53 amount to a verifiable position rather than a promise. That is what the premium buys.
Lightway is ExpressVPN’s proprietary protocol, designed around a deliberately small codebase so it can be reviewed properly, and it supports modern cryptography including ChaCha20 and post-quantum protection. It connects fast, handles switching between Wi-Fi and mobile data smoothly and is easier on battery than heavier protocols.
Use it as your default, and enable Turbo mode if you want additional throughput. Keep OpenVPN for awkward networks or devices that need maximum compatibility, and note that IKEv2 is offered on iOS and macOS only.
Yes. All ExpressVPN servers support torrenting, so you do not need to hunt for a specific location, and the kill switch plus leak protection cover the obvious risks.
There is an important limitation, though: ExpressVPN offers neither port forwarding nor a SOCKS5 proxy. If your workflow depends on either, and some seeding and self-hosting setups do, no plan tier here will provide it, and you should look at a provider that offers them.
It depends on the tier: Basic allows 10 simultaneous connections, Advanced allows 12 and Express Pro allows 14. Apps cover the usual phones, tablets and computers, plus routers, and a router covers everything behind it as a single connection.
If device count is your binding constraint rather than trust or speed, be aware that some competitors impose no limit at all. For most households 10 is ample; for a large shared house it may not be.
Price the bundled products separately. Basic gets you the full VPN with Lightway, TrustedServer, the kill switch, the blocking features and ExpressMailGuard. Advanced adds ExpressKeys, the password manager. Express Pro adds ExpressAI, the private AI chat service, and the largest allowances across the bundled products.
Ignore the identity-protection rows entirely, because Identity Defender is restricted to United States subscriptions. Once those are discounted, most UK buyers land on Basic or Advanced, and Express Pro only makes sense if you want a private AI service.
Basic if you want a serious VPN and nothing else. Advanced if a bundled password manager would replace a subscription you already pay for. Express Pro only for ExpressAI. Use the 30-day money-back guarantee to test your own workflow before committing to a long term.
See current ExpressVPN plans Feature names, tiers and protocol details checked against ExpressVPN’s own pages · Pricing and promotions change constantly
From the best-selling Classic to the adjustable Solaire and the pain-focused Rx: we compared every mattress in Saatva's lineup and matched each one to a sleep style, body type and budget.
Six thousand pieces or six hundred, we went through LEGO's current 18+ range and picked the sets worth the shelf space, the build time and the money.
Samsung's 2026 range runs from a 165Hz QD-OLED flagship to a Micro RGB LCD and an art panel that hides in plain sight. Here's which one belongs in your room.