Is ExpressVPN legit? Yes, it is a legitimate commercial VPN service. Its published privacy policy, identifiable operator and history of external security assessments provide evidence readers can examine. That does not establish that it is the best VPN for everyone, guarantee anonymity or make every marketing claim independently verified.
About this assessment: Stuart has tested ExpressVPN. This update focuses on its published policies, audit disclosures and security information to assess legitimacy and limitations. Earlier hands-on use is distinct from this documentation review; this article does not present new measured speed, streaming or leak-test results.
Who operates ExpressVPN?
ExpressVPN’s privacy policy identifies Express Technologies Ltd., based in the British Virgin Islands, as the service provider and Kape Technologies PLC as its holding company. Ownership is relevant when deciding whom to trust with a VPN connection.
A company’s location alone does not prove its privacy protections. Assess its actual data practices, technical controls and documented responses to problems. A VPN subscription is not a promise of immunity from legal requests or investigations.
What does its no-logs policy cover?
According to its current privacy policy, ExpressVPN does not collect browsing history, traffic destinations, data content or DNS queries. It also says it does not store source or outgoing VPN IP addresses, connection timestamps or session duration.
That is not the same as collecting no information. The policy describes account and payment information, aggregate service-usage information, optional diagnostics and website-related data. Read the sections relevant to the products and settings you use, rather than treating “no logs” as a blanket statement about every interaction with the company.
Is ExpressVPN secure? What the audits establish
ExpressVPN’s Trust Center lists assessments of different components, including its privacy commitments, VPN protocol and applications. These have different scopes and dates; an audit of one component does not certify every product or every future software version.
For example, ExpressVPN published a June 2025 announcement about its third KPMG assessment. It says the assessment covered its no-logs policy and TrustedServer technology. This is the provider’s account of the engagement; readers should consult the underlying report and its scope before relying on the headline.
For any VPN audit, check what was examined, when the work took place, which limitations applied and whether identified issues were fixed. External assessments are useful evidence, but they cannot guarantee that a service will never develop a vulnerability.
Has ExpressVPN had a security problem?
Yes. In February 2024, ExpressVPN disclosed a Windows split-tunneling DNS issue. Under particular configurations, some DNS requests could reach a third-party resolver instead of the intended ExpressVPN resolver. DNS requests can reveal the domain names a device is trying to reach. This was a specific application issue, not evidence that all users’ browsing traffic had been exposed.
In an April 2024 follow-up, ExpressVPN reported deploying a fix and commissioning Nettitude to assess the Windows app and confirm remediation. The follow-up links to the audit report. The disclosure and subsequent work belong in a balanced assessment of the service; describing its history as having no security incidents would be inaccurate.
A later July 2025 security disclosure described another Windows issue: TCP traffic on port 3389 could bypass the VPN tunnel in versions 12.97 through 12.101.0.2-beta, potentially exposing the user’s real IP address. This affected more than Remote Desktop traffic alone. ExpressVPN identifies version 12.101.0.45 as containing the fix. These are historical affected and remediation versions, not advice to install an old release. Published audits do not rule out later application bugs. Keep the app updated and review disclosures relevant to your operating system. This account is based on the provider’s disclosure, checked on 23 September 2026, not a reproduction of the vulnerability by Impulsec.
Is ExpressVPN safe? Protections and limitations
ExpressVPN documents a kill switch intended to restrict traffic when VPN protection is interrupted. Its options and behavior vary by operating system. Check the instructions for your device rather than assuming that every app has identical settings or defaults.
The service also offers a dedicated IP add-on, documented in its privacy policy. Older advice saying ExpressVPN has no dedicated IP option is outdated. Whether you need a stable IP address is a separate question from whether the VPN service is legitimate.
A VPN can encrypt the connection between your device and its VPN server and change the public IP address websites see for traffic routed through that server. It does not remove every way of identifying you. Signing into an account still identifies you to that service; cookies and browser fingerprinting can also support tracking.
Nor does a VPN replace software updates, strong passwords, multifactor authentication or caution with downloads and messages. It cannot make a fraudulent website trustworthy. On public Wi-Fi, continue to use HTTPS and take browser certificate warnings seriously.
What should you check before paying?
- Your devices: Start with the official download page and check the requirements for each operating system. A supported platform does not mean every older OS version or device has the same features.
- The full subscription cost: Check the amount charged today, subscription length, renewal price, taxes and any add-ons at checkout. Do not judge value solely by a monthly equivalent displayed for a prepaid term.
- Refund and cancellation terms: Read the terms that apply to your purchase channel and plan before subscribing. Do not assume that a refund policy means a subscription is free.
- The feature you actually need: Confirm that the relevant plan and app support it. Avoid paying for a long subscription solely on a claim about a streaming service, country or device that has not been checked.
- Performance on your connection: Test the applications and locations you use. This article supplies no measured speed or streaming results, so it cannot substantiate a claim that ExpressVPN is faster or more reliable than a named competitor.
Is ExpressVPN trustworthy? Our assessment
Our judgment: ExpressVPN is a legitimate service worth evaluating, but legitimacy is not proof that it is the best VPN for your needs. Its identifiable operator, published policies and documented external assessments support that conclusion. The useful comparison is between the evidence for a claim and its scope: a policy assessment addresses specified privacy commitments, while an app security assessment addresses particular software. Neither supplies a comparable speed or reliability score. We therefore do not declare a performance winner over another VPN from audit headlines alone.
Choose it only if its current terms, device support and privacy approach fit your needs. If you require protection against targeted surveillance or a compromised device, a consumer VPN alone is not a complete security plan.
If you already use ExpressVPN and need help with connection failures or browsing problems, follow our ExpressVPN troubleshooting guide.
Frequently asked questions
Is ExpressVPN legitimate or a scam?
ExpressVPN is an identifiable commercial VPN service with published policies and external audit disclosures. That supports its legitimacy, but does not mean every advertised benefit will meet your needs. Use its official website or the app-store links it provides to avoid impersonators.
Does ExpressVPN make you completely anonymous?
No. A VPN changes some network visibility, but account logins, cookies, browser fingerprinting and activity on your device can still identify you. No VPN should be treated as a guarantee of anonymity.
Has ExpressVPN ever had a DNS issue?
Yes. It disclosed a Windows split-tunneling DNS issue in February 2024 and reported a fix and subsequent assessment in April 2024. See the remediation announcement and linked report for the scope.
Did Impulsec test ExpressVPN for this article?
This version is based on a review of published policies, disclosures and support documentation. It does not present new hands-on speed, streaming or leak-test results.
Related Posts
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.
Fair point. In ExpressVPN’s case, the independent auditors they cite include KPMG, Cure53, and PwC Switzerland, and their Trust Center lists the audit history publicly. The most relevant ones for this article are the KPMG privacy / no-logs audits and the Cure53 TrustedServer audit. You’re right that naming the firms and linking the reports would make the review stronger.
Who is doing these “independent audits”? Just saying it means nothing. References would be good start. Unless that’s beyond the scope of this review.