ExpressVPN: the thing behind the ads

This company's name showed up eleven times in one week of my podcast queue, and I only commute down Bellaire twice a day. Same read, different shows, sometimes followed by a mattress ad promising to fix back pain the mattress caused. I have heard ExpressVPN described as "military-grade encryption" more often than I have heard any CVE explained correctly, which is a sentence that should embarrass both industries.

I ran it for a year on my own money, on a TV and a laptop, mostly for travel use. The current pricing table sells Basic at $2.99 a month, billed $83.72 for 28 months, then autorenewing at $99.95 a year. That renewal number is the most important fact in this post, so let's start there.

the part everyone gets wrong

People judge ExpressVPN by its marketing, which is loud, everywhere, and aimed at people who don't know what a protocol is. The marketing is the worst thing about the company and tells you nothing about the implementation. The technical work is actually decent, which surprises people who assume the sponsorship volume means the product is empty.

The real issue isn't marketing either. It's two facts that never make it into the podcast read: the renewal price, and who owns the company. Everything else in this post is me being fair to both.

the mechanics

The protocol is Lightway, open sourced in 2023 so you can read the core, built on standard primitives rather than custom crypto. Servers run from RAM and get wiped on reboot, their TrustedServer arrangement, so a seized box holds less than a normal disk-based deployment. The company is incorporated in the British Virgin Islands, and third-party audits of the clients have been published, Cure53 among the first. All of that is legitimate engineering, and I'm not going to pretend otherwise because I dislike the ad copy.

The 2021 Turkey seizure is the case study I respect. Turkish authorities took a physical server as part of the Khashoggi investigation, and it yielded nothing about customers, because there were no connection logs on disk and no way to have any. Whether or not you trust a company's promises, architecture you can verify beats a policy page, and that seizure is the closest thing ExpressVPN has to evidence.

Device counts are 10 to 14 depending on tier, enforced loosely in practice. Dedicated IP is an add-on on Basic, included on the top tier. Advanced Protection, their DNS-level tracker blocker, works like every other DNS filter and works fine.

where it breaks

The renewal math is the trap. $83.72 reads as $2.99 a month, and then year two bills at $99.95, which is about triple the annualized intro rate. I'm not calling this a scam, it's the standard VPN playbook, but it's the standard playbook and the read never mentions it. My admission: I autopaid the renewal year without noticing, and only caught it doing the pricing math for this post. That mistake cost me about $60 I would not have spent if the number had been on the invoice in the same font size as the intro price.

Ownership is the trust question, and it's not a conspiracy theory. ExpressVPN is owned by Kape Technologies, which was Crossrider, a company with an ad-injection history that security people my age remember unkindly. Kape also owns Private Internet Access, CyberGhost, and a chunk of the review ecosystem that ranks VPNs. The acquisition turned Express from independent to subsidiary in 2021, and the honest description is that the security engineering has stayed competent while the corporate structure got more complicated to defend.

The bundle bloat on the upper tiers is where the pitch stops being a VPN. Identity Defender, data removal, up to $5 million in identity theft insurance underwritten by an Assurant company, an eSIM with 3GB, AI credits, a password manager. That's not a VPN purchase anymore, it's a lifestyle subscription, and every dollar of it is marketing budget. I'd rather pay Mullvad's flat €5 for a product that does one thing.

Streaming is the actual use case, and to be fair, it's good at it: server pools that streaming services haven't flagged, fast enough for 4K on a decent connection. If your threat model is "my hotel's wifi and another country's streaming catalog," this works and I can't argue with it.

what to do

1. If you want it for travel and streaming, buy the shortest intro term and set a calendar reminder for a week before renewal. The reminder is worth more than any feature.
2. If your threat model is ISP or network trust, read the Lightway source instead of the landing page, then compare with Mullvad or Proton's free tier before paying triple at renewal.
3. Skip the identity insurance bundle. If you want identity monitoring, buy it from a company that monitors identities, not one that also routes your traffic.
4. Turn on the kill switch and Network Lock the day you install, whichever tier you pick.
5. Use the 30-day money-back window deliberately: install, run your real traffic, decide inside a week, don't let the window lapse out of inertia like I let my renewal lapse out of inertia.

The podcast host who read the VPN ad also read one for a Houston personal injury firm, same week, same voice, and I remember his dog's name from a third read and not a single CVE number from any of them.

Set the renewal reminder before you forget you set the intro price.