The review
ExpressVPN is the one you can check most thoroughly, and for some readers that is worth the price on its own. It has commissioned published audits every year since 2018 from Cure53, KPMG, PwC, F-Secure and Praetorian, covering not just the no-logs claim but the Lightway protocol, the apps, the browser extensions, the router and even the process that builds the binaries. Its RAM-only server design has been verified by two of those firms rather than simply asserted. Add low jitter, which governs whether a call holds up better than raw speed does, and 113 countries.
Two failures belong in the same breath. A DNS leak in the Windows app ran from May 2022 to February 2024 and, in ExpressVPN’s own words, was missed by every audit. And in 2025 a piece of debug code left in a production build exposed users’ real IP addresses during remote desktop sessions — a narrow bug for most people, and directly in the path of anyone who reaches their employer’s machines that way. Both were fixed, the second through a paid bug bounty.
The last thing to know is who owns it. ExpressVPN was bought by Kape Technologies in 2021. Kape also owns CyberGhost, Private Internet Access and ZenMate — and, by its own filing to shareholders, the companies behind two of the largest VPN review sites, which rank its brands at the top. None of that is hidden, and it is not evidence the VPN is bad. It is a reason to be careful which reviews you trust, including any that put this one first.
What works
- The longest published audit record in the industry, since 2018
- RAM-only servers verified by PwC and Cure53, not just claimed
- Low jitter, the measure that matters for all-day calls
- 113 countries, including all 50 US states
- A bug bounty that demonstrably works and pays out
What does not
- $99.95 a year on renewal, and only 14 days to escape one
- A 2025 bug exposed real IPs during remote desktop sessions
- A Windows DNS leak ran for two years and every audit missed it
- Owned by Kape, which also owns the review sites that rank it