Is ExpressVPN Safe? Permissions, Privacy and Ownership Checked

Is ExpressVPN safe to use in 2026?

Yes, for everyday privacy on public Wi-Fi, streaming and hiding your IP from websites, ExpressVPN is a reasonable, low-risk choice. It is not a scam, it has a documented track record, and its core privacy claims have been tested in public at least once.

Safe does not mean anonymous, though. A VPN moves trust from your internet provider to the VPN company. So the useful question is not only whether the app is secure, but whether you trust the people who run the servers. That is where ownership, logging and incident history matter more than marketing pages.

If you want a paid VPN with a clean operational record and you are comfortable with the ownership question, it is a sound pick. If ownership by a larger holding company bothers you, the alternatives section below covers independent options.

Who owns ExpressVPN, and should that worry you?

ExpressVPN has been owned by Kape Technologies since 2021. Kape also owns other VPN brands, including CyberGhost and Private Internet Access, which is why reviews on Reddit often raise the ownership question before anything else.

The concern comes from Kape's past. Before rebranding, the company was called Crossrider, and its software platform was widely associated with bundling adware into downloads. Kape says that business is long gone, and nothing public shows ExpressVPN's apps inheriting that behaviour. Still, a VPN is a trust product, so it is fair to weigh it.

The second talking point is people. In 2021, ExpressVPN's then chief information officer, Daniel Gericke, was named in a US Justice Department agreement with former intelligence operatives over hacking work done for the United Arab Emirates, years before he joined ExpressVPN. The company kept him on and said it knew about his background when hiring him.

ExpressVPN's operating company is registered in the British Virgin Islands, which has no mandatory data-retention law for VPN providers. Jurisdiction helps, but the logging policy and server design do more of the real work, as the next section explains.

Does ExpressVPN keep logs of what you do?

Its privacy policy says it does not keep activity logs, DNS queries, or records tying your originating IP address to your VPN sessions. It does keep account basics such as your email, payment details and some aggregate connection data, like which app version you use and how much data you transfer in total.

The strongest evidence is the 2016 incident in Turkey. Investigators seized an ExpressVPN server while looking into the assassination of the Russian ambassador, and found nothing that identified users. That is rare real-world proof, not a claim on a sales page.

TrustedServer

ExpressVPN's name for running servers from RAM rather than hard drives, so data is wiped on every reboot and nothing persists to seize later.

Lightway

Its own VPN protocol, published as open source so outsiders can review the code instead of taking the company's word for it.

Independent audits

Firms including PwC and Cure53 have reviewed its no-logs setup, servers and apps at different times. Audits cover a point in time, so check the dates.

Account data

Email and payment details are kept for billing. Paying with a less personal method reduces what is linked to you, if that matters for your threat model.

Together these make ExpressVPN's no-logs claim more credible than most. They do not make it verifiable in real time, and no VPN can offer that. Treat audits as a strong signal, and re-check them if ownership or leadership changes again.

What permissions does the ExpressVPN Chrome extension need?

Check the live list yourself, because permissions change between versions and Chrome shows the current set before you install. A VPN or proxy extension genuinely needs broad access to route your traffic, so the question is whether each permission maps to a feature, not whether the list is short.

ExpressVPN's Chrome extension has historically worked alongside its desktop app, acting as a browser-side control panel with extra protections such as location spoofing and WebRTC leak blocking. Its official Chrome page explains the current setup requirements.

1. Open the ExpressVPN listing in the Chrome Web Store and scroll to Privacy practices to see what data the developer declares it collects.
2. Click Add to Chrome. The dialog lists the permissions in plain words, such as Read and change all your data on all websites. Read it before confirming.
3. After installing, go to the ⋮ menu > Extensions > Manage Extensions, then click Details under ExpressVPN.
4. Under Permissions, review the full list. Under Site access, see whether it runs on all sites.
5. Revisit this page after updates. If Chrome disables the extension and asks you to approve new permissions, find out why before accepting.

Our guides to the all-URLs permission and the tabs permission explain the risk of each in more depth, and the full permissions glossary covers the rest.

Can you be tracked with ExpressVPN?

Yes. ExpressVPN hides your IP address and encrypts traffic between your device and its server, but websites can still identify you by other means. A VPN is one layer, not an invisibility cloak.

• Logged-in accounts: if you are signed in to Google, Facebook or Amazon, they know it is you regardless of IP.
• Cookies and trackers: third-party scripts follow you across sites. A content blocker handles this far better than a VPN.
• Browser fingerprinting: screen size, fonts and hardware details can single out a browser without cookies.
• Leaks: WebRTC or DNS leaks can expose your real IP if protection is off. The Chrome extension's leak settings exist for this reason.
• Payment trail: your subscription is tied to an account, so the company knows you are a customer, even if it does not log what you do.
• Malware on the device: a VPN does nothing against spyware already installed on your computer or phone.

Are there any dangers in using a VPN, and what is the safest free VPN?

The main danger is handing all your traffic to a company that monetises it. Paid services like ExpressVPN earn from subscriptions; many free VPN extensions have to earn from something else, such as data, ads or selling bandwidth. Read the privacy policy before trusting a free VPN with every page you load.

Other risks are practical: a false sense of anonymity, broken sites that block VPN IP ranges, slower connections on distant servers, and legal limits in countries that restrict VPN use. None of these make a reputable VPN unsafe, but they are worth knowing.

ExpressVPN itself is not free. It has historically offered a money-back guarantee on new subscriptions instead of a free tier; check the current terms on its site because offers change. If you need a free option, pick one with a clear business model, which is usually a freemium plan subsidised by paying users.

Our VPN extension picks are ranked with these trade-offs in mind, using the criteria explained in our review methodology.

Which ExpressVPN settings make it safer?

A few settings matter more than server choice. Turn on the kill switch, keep leak protection on in Chrome, and let the app pick a modern protocol. Menu names can shift between app versions, so look for the equivalent if a label differs.

1. In the desktop app, open Options or Preferences and enable Network Lock, ExpressVPN's kill switch that blocks internet traffic if the VPN drops.
2. Under the protocol setting, choose Automatic or Lightway rather than older protocols unless a network forces you to switch.
3. In the Chrome extension settings, keep WebRTC leak protection and location spoofing switched on.
4. Review split tunneling and make sure sensitive apps are not excluded from the VPN by mistake.
5. Update the app and extension promptly; Chrome updates extensions automatically, but desktop apps may need a manual update.
6. Test for leaks by visiting an IP or WebRTC leak test page with the VPN on, and confirm it shows the VPN server, not your home IP.

Then cover what the VPN cannot: use a password manager like Bitwarden, turn on two-factor codes for important accounts, and consider an extension that wipes history and cookies on a schedule if you share a computer.

Is ExpressVPN worth it, or is an alternative safer?

ExpressVPN is worth it if you value a polished app, a tested no-logs record and wide server coverage, and the price suits you. If ownership is your deciding factor, Proton VPN is the usual alternative, with open-source apps and a free tier.

On ExpressVPN vs NordVPN, both are established paid services with audited no-logs claims, so the choice often comes down to app preference, features and price rather than safety. Compare more options in our security and privacy category, or read the Proton VPN profile for a closer look at the leading alternative.