Is ExpressVPN Safe?
2026 Security, Privacy and No-Logs Analysis
The Short Answer
Yes, I still consider ExpressVPN safe for most users in 2026. The reasons are fairly concrete: its no-logs claims have been independently assessed, TrustedServer runs in RAM rather than writing the VPN server stack to disk, and both Lightway and ExpressVPN's WireGuard implementation include modern security work such as post-quantum ML-KEM protection. I would be comfortable using it for public Wi-Fi, travel, streaming, online banking and ordinary private browsing.
When I assess ExpressVPN, I put more weight on what can be checked than on the marketing language. The strongest evidence is the repeated third-party audit history, the RAM-only TrustedServer design, the current privacy policy, private DNS, audited Lightway code and the newer privacy-enhanced WireGuard implementation with ML-KEM.
I would not describe any commercial VPN as perfect or anonymous against every threat model. Kape Technologies ownership is still a fair trust question, and the old Windows split-tunnelling DNS bug is a reminder that even good VPN apps can ship security mistakes. The difference here is that the Windows issue was fixed and independently checked, while ExpressVPN continues to publish audits and transparency data. For mainstream privacy use, I still put it among the stronger options.
ExpressVPN Safety Verdict
I do not judge safety by whether a provider says it is “secure”. I look at the logging design, server architecture, protocol implementation, audit record and what happens when the service is tested under pressure. ExpressVPN does well on those points: its policy says it keeps no activity or connection logs, TrustedServer has been independently assessed, and the well-known Turkish server seizure did not produce customer activity or connection logs according to ExpressVPN's published account.
Why ExpressVPN looks safe
- Audited no-logs VPN policy covering activity logs and connection logs.
- TrustedServer RAM-only infrastructure designed to avoid persistent server data.
- Lightway and custom WireGuard support with post-quantum ML-KEM protection.
- Real-world Turkey server seizure history where no useful logs were available.
- British Virgin Islands jurisdiction with no mandatory VPN data retention law.
What to question
- Kape Technologies ownership remains a fair trust concern for privacy purists.
- The old Windows split-tunnelling DNS issue shows why VPN apps must be kept updated.
- Advanced Protection is useful, but it is not a replacement for antivirus or safe browsing.
- No VPN can make illegal activity safe or guarantee total anonymity against every adversary.
Does ExpressVPN Keep Logs?
I checked ExpressVPN's current privacy policy again for this update; it is dated 1st January 2026. The policy says ExpressVPN does not log browsing history, traffic destinations, data content or DNS queries, and does not keep connection logs containing your source IP, assigned VPN IP, connection timestamp or session duration.
What ExpressVPN does collect
There is still account and operational data involved. ExpressVPN can hold information such as your email address and payment-related details, and its policy describes limited service data and optional diagnostics used for reliability and support. I separate that from VPN activity logging: having an account is not the same thing as the provider keeping a history of the websites you visit.
My takeaway is that ExpressVPN is a no-logs VPN in the sense most people mean it: it says it does not retain browsing activity, DNS history, source-IP connection history or session timestamps. It is not an account-free service, so people with a stricter threat model should still minimise the identifying information they hand over.
ExpressVPN Security Features
The parts I care about most are the tunnel, DNS handling, kill switch, server design and authentication around the protocols. Those are the controls that decide whether a VPN failure becomes an IP or DNS exposure rather than just an inconvenience.
| Feature | What It Means | Safety Impact |
|---|---|---|
| Lightway | ExpressVPN's proprietary VPN protocol, now reimplemented in Rust and audited. | Designed for fast reconnection, mobile reliability and a smaller codebase than older protocol stacks. |
| Custom WireGuard | ExpressVPN's privacy-enhanced WireGuard implementation on iOS, Android, Windows, macOS, Linux and Apple TV. | Adds hybrid ML-KEM handshakes, ephemeral credentials, fresh internal IPs, short-lived access tokens and TrustedServer provisioning. It also matters for modern ciphers such as ChaCha20 encryption in relevant VPN protocol contexts. |
| ML-KEM | Post-quantum key encapsulation used in ExpressVPN's modern protocol design. | Helps reduce “harvest now, decrypt later” risk from future quantum-capable attackers. |
| TrustedServer | RAM-only server architecture. | Servers are designed not to write operational VPN data to persistent hard drives. |
| Private DNS | DNS requests should go through ExpressVPN's own DNS while connected. | Reduces ISP visibility into domains you visit when the app is working correctly. |
| Network Lock | ExpressVPN's kill switch. | Helps prevent traffic exposure if the VPN connection drops unexpectedly. |
Is Lightway better than WireGuard?
I would not call either protocol universally “better”. Lightway is mature, open source and repeatedly audited, while ExpressVPN's WireGuard implementation is now a genuine alternative across its main desktop and mobile platforms. The important update is that ExpressVPN no longer avoids WireGuard: its version adds ML-KEM, short-lived credentials, fresh internal IPs and TrustedServer provisioning around the standard protocol.
Current Caveats
Resolved Windows split-tunnelling DNS issue
This was a real bug, but it was narrower than a general VPN leak. Some Windows Version 12 builds could send certain DNS requests outside ExpressVPN's DNS protection when split tunnelling was configured in specific ways. Split tunnelling was removed in 12.73.0 while ExpressVPN fixed the problem and restored from 12.74.0; ExpressVPN says the VPN encryption itself was not affected.
I would still keep the Windows app current and run a DNS leak check after changing split-tunnelling rules. ExpressVPN's support page, last updated in June 2026, says both identified split-tunnelling DNS bugs are fixed and that the remediation was independently audited.
Legacy app versions retired after 31st March 2026
The March 2026 legacy-app cutoff has now passed. ExpressVPN retired older certificate infrastructure after 31st March, so unsupported legacy clients can no longer connect to the VPN. If an old installation still has normal internet access but the VPN will not connect, update the app before assuming you are protected.
Advanced Protection is not a full antivirus
ExpressVPN's threat blocking and tracker blocking features can help with some malicious domains, ads and tracking, but they do not replace endpoint security, browser hardening, software updates or phishing awareness. A safe VPN protects the tunnel; it does not make unsafe downloads safe.
Ownership and Jurisdiction
Is ExpressVPN owned by Kape?
Yes. ExpressVPN has been part of Kape Technologies since 2021. I do not dismiss that concern, because ownership matters when you are choosing a privacy service. I balance it against the evidence produced since the acquisition: repeated audits, the TrustedServer design, the published no-logs policy, ISO certification work and regular transparency reports.
British Virgin Islands privacy angle
ExpressVPN is operated under British Virgin Islands jurisdiction. The BVI is a British Overseas Territory with its own legal system, and ExpressVPN says BVI law governs its operations. The key privacy point is that ExpressVPN says it cannot hand over activity logs or connection logs it does not possess.
ExpressVPN Audit History
Audit scope matters more to me than the headline number. ExpressVPN's Trust Center lists a long run of third-party work across the VPN and its wider privacy products. By July 2026, ExpressVPN said the wider portfolio had reached 28 published independent audits. The latest core VPN no-logs and TrustedServer assessment is still the 2025 KPMG engagement, so I would not use audits of newer add-on products as if they were fresh proof of the VPN's no-logs policy. We cover the wider history in our page on ExpressVPN's latest security audits.
- 2026: Cure53 reviews of newer ExpressVPN products pushed the wider published third-party audit total to 28; these are useful transparency evidence but are not new no-logs audits of the VPN service.
- 2025: KPMG carried out the third published KPMG security assessment of ExpressVPN's privacy commitments, covering TrustedServer and privacy-policy controls as at 28th February 2025.
- 2024–2025: Cure53 and Praetorian assessed the Rust rewrite of Lightway in 2024; ExpressVPN published the results alongside the Rust release in February 2025.
- 2024: Windows app work addressed and verified DNS/split-tunnelling remediation.
- 2023: KPMG assessed ExpressVPN's privacy policy claims.
- 2022 and earlier: ExpressVPN commissioned audits of apps, TrustedServer, Lightway and no-logs controls from firms including KPMG, Cure53, F-Secure and PwC Switzerland.
What changed in 2026
Two newer trust signals are worth adding. ExpressVPN says it and the wider Kape Group secured ISO/IEC 27001, ISO 9001 and ISO 18295-1/18295-2 certifications during 2025. These are governance and management-system certifications, not proof of a no-logs claim, but they add another layer of external oversight.
More directly relevant to privacy, ExpressVPN's January–June 2026 transparency report says it received three warrants and a large volume of copyright and other requests, with no request resulting in disclosure of VPN activity or connection logs. I see that as useful operational evidence alongside the formal audits.
The Turkey server seizure test
There is also an older real-world test that I still think is relevant. During the Andrey Karlov investigation, Turkish authorities inspected an ExpressVPN server. ExpressVPN said the server contained no customer activity or connection logs that could identify a user. It is historical evidence rather than a substitute for a current audit, but it is more meaningful than a provider simply repeating “no logs” on a sales page.
Is ExpressVPN Safe for Specific Uses?
Online banking
ExpressVPN is generally safe for online banking, especially on public Wi-Fi, because it encrypts traffic between your device and the VPN server. Banks may still trigger extra verification if your VPN location changes.
Public Wi-Fi
ExpressVPN is a strong choice for airports, hotels, cafes and school Wi-Fi because it protects traffic on untrusted networks and can reduce local network snooping.
Torrenting
ExpressVPN can improve privacy for P2P traffic, but it does not legalise copyright infringement. Keep Network Lock enabled and test for DNS and IP leaks.
iPhone, Android, Mac and Windows
ExpressVPN is safe on major platforms when you use the latest official app. The main device-specific warning is to update Windows builds and avoid old legacy versions.
Sources Checked
I refreshed this page on 3rd September 2026 against ExpressVPN's current public material. I checked the January 2026 privacy policy, Trust Center, 2025 KPMG report, current WireGuard and split-tunnelling documentation, the legacy-app cutoff notice, 2026 ISO-certification update, January–June 2026 transparency report, Kape acquisition announcement and the historical Andrey Karlov investigation statement.
- ExpressVPN Privacy Policy
- KPMG 2025 no-logs and TrustedServer audit announcement
- ExpressVPN WireGuard protocol explainer
- Windows split-tunnelling DNS issue support note
- Legacy app update notice
- ExpressVPN statement on Andrey Karlov investigation
- ExpressVPN joins Kape Technologies announcement
- ExpressVPN Trust Center and audit history
- ExpressVPN 2025 ISO certifications and 2026 security roadmap
- ExpressVPN Transparency Report: January–June 2026
FAQs
Is ExpressVPN safe to use in 2026?
Yes. I still consider ExpressVPN safe for most everyday users. Its case is stronger than a simple marketing claim because the no-logs and TrustedServer controls have been independently assessed, the server design is RAM-only, and its current protocols include post-quantum protection.
Does ExpressVPN keep logs?
ExpressVPN says it does not keep activity logs or connection logs. That means no browsing history, traffic destination, data content, DNS queries, source IP address, outgoing VPN IP address, connection timestamp or session duration. It does collect account and limited operational data needed to provide and support the service.
Is ExpressVPN trustworthy after Kape ownership?
I think Kape ownership is a fair reason to look more closely, but not enough on its own to call ExpressVPN unsafe. Since the acquisition, the VPN has continued to publish audits, transparency reports and technical documentation around TrustedServer, logging controls and protocols.
Was ExpressVPN affected by a DNS leak?
Some Windows Version 12 builds had a split-tunnelling DNS issue in specific configurations. It was not a general ExpressVPN IP leak. ExpressVPN removed split tunnelling in Windows 12.73.0 while fixing the issue and restored it from 12.74.0. Users should update to the latest Windows app.
Is ExpressVPN safe for online banking and public Wi-Fi?
Yes, ExpressVPN is generally safe for online banking and public Wi-Fi because it encrypts traffic between your device and the VPN server. Your bank may still ask for extra verification if the VPN location changes, which is normal fraud prevention rather than a VPN safety issue.
Is ExpressVPN anonymous?
ExpressVPN improves privacy, but no VPN guarantees total anonymity. It can hide your IP address from websites and protect traffic on local networks, but your account data, payment method, browser fingerprint, logged-in accounts and online behaviour can still identify you.
Is ExpressVPN safe in restrictive countries?
ExpressVPN may help on restrictive networks, but access and local laws can change quickly. Install and update the app before travelling, check the legal position in the country you are visiting, and do not assume a VPN makes risky activity safe.
