ExpressVPN spent more than a decade as a single product with a single job: encrypt a connection and route it through a server network. That is no longer the whole story. The company now sells a tiered subscription that bundles a password manager, an email privacy service, a U.S.-only identity monitoring tool, a browser-based AI feature, a travel eSIM benefit, and separately purchased router hardware, alongside the VPN itself.
The honest summary is that ExpressVPN is an expanding platform with uneven maturity. The core VPN is long-established, broadly deployed, and supported by current technical documentation. The newer products around it are real, but they are recent, delivered through separate apps and services, gated by plan and subscription term, and in at least one case, limited to users in a single country. Whether that wider bundle earns its place next to the VPN, or simply rides alongside it on the same invoice, is not something the available evidence can resolve yet.
This article is not judging ExpressVPN against competitors. It is assessing what the current bundle includes, how mature each component is, and what subscribers actually receive by plan, term and region.
What’s included beyond the core VPN
ExpressVPN now spans multiple adjacent product categories beyond the core VPN. As of the current subscription structure, a subscriber’s account may include:
- ExpressKeys, a standalone password and credential manager
- ExpressMailGuard, an email relay service included at every tier, with allowances that vary by tier
- Identity Defender, a dedicated identity monitoring app available only to users in the United States
- ExpressAI, a browser-based AI tool
- A holiday.com eSIM benefit, included on some annual and two-year terms for a fixed number of days
- Aircove and Aircove Go, separately purchased VPN router hardware
- Teams, a distinct business product with its own licensing, sold apart from the consumer plans covered here
Each of these arrives through a different delivery model. A password manager is not the same kind of thing as a browser tool, and neither is the same kind of thing as a physical router. That difference matters more than it sounds, because how a feature is delivered says a great deal about how tightly it is actually connected to everything else a subscriber is paying for.
The core VPN remains the strongest part of the product
If one part of ExpressVPN can be called established, broadly deployed, and supported by current evidence, it is the VPN itself. The Lightway protocol and TrustedServer infrastructure underpin the core product, and two platforms in particular show that maturity in current, verifiable detail.
Current macOS release notes confirm that app-based split tunneling is available on macOS 11 and later. That is worth stating plainly because older characterizations of ExpressVPN’s Mac app described split tunneling as unavailable. That description no longer reflects the current release. On Linux, the official command-line documentation shows a materially deeper feature set than an older, thinner characterization would suggest: protocol selection between Lightway and OpenVPN, app-based split tunneling, content blocking, and Network Lock enabled by default. Linux support should not be described as browser-extension-only. Current documentation does not support that claim.
None of this means the VPN is superior to competing products, since no comparative evidence is available here. It means the core function has a current, verifiable technical record that the newer products around it do not yet share.
The newer products: what each one actually offers
Breadth is real. Maturity is not evenly distributed across it. Each of the newer products deserves its own accounting rather than a single description applied to all of them.
ExpressKeys is a standalone password and credential app, included on Advanced and Express Pro plans but not on Basic. It received a dedicated security assessment from Cure53 in 2026. That assessment establishes bounded scrutiny within its stated scope. It does not establish how the tool performs in practice, how widely it is used, or whether it exports data in a portable format, since none of that is documented.
ExpressMailGuard is an email relay service included at every tier, though the number of domains, aliases, recipients, and rules it allows varies materially by tier. It also underwent a separate 2026 Cure53 engagement. As with ExpressKeys, that engagement confirms scope-bounded review, not adoption or day-to-day reliability.
Identity Defender is a dedicated, separate identity monitoring app. Its documented value applies only to eligible U.S. users; it contributes no currently available benefit to subscribers outside that region. The full version is available on Express Pro. A limited version is available on annual or two-year Advanced plans, while monthly Advanced and Basic do not include it. It, too, has a separate 2026 Cure53 assessment behind it.
ExpressAI is delivered through the browser rather than the core app, and is included only on Express Pro. Its Cure53 engagement is likewise scope-bounded, and no usage or adoption evidence exists for it.
The holiday.com eSIM benefit is a third-party travel service bundled into certain terms: three days on Advanced annual or two-year plans, five days on Express Pro annual or two-year plans, and absent entirely from monthly subscriptions and from Basic. Destination counts vary across ExpressVPN’s own pages, so no specific country figure is reliable enough to repeat here.
Aircove and Aircove Go are separately purchased router hardware that require an active ExpressVPN subscription to function fully as VPN routers. Independent reviews describe performance and connection issues on individual units. That is a bounded, unit-level signal. It does not establish a product-wide reliability defect, and no broader replication across firmware versions or multiple units was found.
Across all of these, one distinction matters more than any individual feature description: a security audit is not evidence of utility, adoption, reliability, or product-market fit. It confirms that a named firm looked at a defined scope on a defined date. Nothing more should be read into it.
What’s included in Basic, Advanced and Pro
Tier alone does not tell a subscriber what they are getting. Subscription term does too, and in several cases it changes the answer entirely.
| Included | Basic | Advanced, monthly | Advanced, annual/two-year | Express Pro, monthly | Express Pro, annual/two-year |
|---|---|---|---|---|---|
| Connections | 10 | 12 | 12 | 14 | 14 |
| ExpressKeys | Not included | Included | Included | Included | Included |
| ExpressMailGuard | Limited allowances | Expanded allowances | Expanded allowances | Full allowances | Full allowances |
| Identity Defender | Not included | Not included | Limited, U.S. only | Full, U.S. only | Full, U.S. only |
| ExpressAI | Not included | Not included | Not included | Included | Included |
| holiday.com eSIM | Not included | Not included | 3 days | Not included | 5 days |
| Dedicated IP | Separate purchase | Separate purchase | Separate purchase | Included on different terms | Included on different terms |
| Ad and malicious site blocking | Included | Included | Included | Included | Included |
| Adult site blocking | Unresolved, see below | Not documented here | Not documented here | Not documented here | Not documented here |
Two things stand out. First, an Advanced or Express Pro subscriber on a monthly term does not receive the same entitlements as an annual or two-year subscriber on the same tier: the eSIM benefit and the fuller versions of Identity Defender only appear on longer terms.
Second, Basic’s adult site blocking status cannot be resolved from current documentation. ExpressVPN’s own subscription support page states in its prose that the feature is included, while the comparison table on the same page marks it as unavailable. That is a genuine contradiction in the company’s current material, not an editorial gap, and it should be treated as unresolved rather than assumed either way.
This structure is best described as higher-tier subscription bundling. It is not evidence of a premium tier, a higher-value tier, or a complete suite, since none of those judgments follow from entitlement structure alone.
Subscribers who joined before the current tier system was introduced were told they would not be forcibly moved onto it. What happens if they later choose to upgrade, downgrade, or try to revert is not documented, and should not be assumed to work smoothly or to trap them in place.
Where the feature set is genuinely consistent, and where it isn’t
Current evidence supports genuine platform depth in two places. macOS 11 and later confirms app-based split tunneling, and the Linux CLI confirms protocol choice, split tunneling, content blocking, and Network Lock enabled by default. Both are current findings, not carryovers from older documentation.
Beyond those two platforms, the picture is incomplete rather than negative. Exact iOS split-tunneling behavior, the extent of advanced features on television apps, the boundary between what the browser extension controls versus the desktop app, and the specific conditions under which Lightway Turbo is available are all open questions in current documentation. That is not the same as saying those platforms lack the features. It means there isn’t enough current, primary evidence to state a position either way, and no claim of full cross-platform consistency should be made here.
Is ExpressVPN one integrated product?
ExpressVPN sells its products through a coordinated account and subscription structure, but the evidence supports only partial integration across the user experience and underlying architecture.
At the commercial and account level, integration is real. One subscription relationship governs the whole bundle, and the ExpressVPN+ dashboard shows a subscriber which of these tools their plan includes.
At the level of daily use, the picture is different. ExpressKeys is a standalone app. Identity Defender is a dedicated, separate app. ExpressAI runs in the browser. ExpressMailGuard operates as an email relay service, a different technical model from a VPN client entirely. Aircove is a physical device. Five different delivery surfaces sit under one subscription.
At the architectural level, there is a further distinction worth being precise about. No public evidence establishes shared backend services, unified data flows, common deletion controls, or shared authentication across these products. That is a limit on the evidence, not proof that no such integration exists behind the scenes. The absence of a public architecture map means the claim of deep technical integration simply is not supported either way, and neither is its opposite.
Commercial and account-level bundling is not the same as functional or architectural integration. One dashboard and one invoice do not, by themselves, make five separately delivered products into one system.
Who gets the most out of the current bundle
Basic subscribers receive the core VPN, ad and malicious site blocking, and a limited version of MailGuard. Basic covers the documented core VPN proposition but excludes the newer adjacent products entirely: no ExpressKeys, no ExpressAI, no Identity Defender. The unresolved adult site blocking question sits specifically at this tier, which makes it a direct point of friction for exactly the subscribers who see it.
U.S.-based subscribers on Express Pro receive the broadest documented bundle available: full Identity Defender, full MailGuard, ExpressKeys, and ExpressAI, none of which are reduced by the regional gating that affects Identity Defender elsewhere.
Subscribers outside the U.S. can pay for the same higher tier without access to Identity Defender’s core benefit. Its documented value applies only to eligible U.S. users; it contributes no currently available benefit to subscribers outside that region, and that is a real, documented limitation on what a non-U.S. subscriber gets for paying a higher tier, not a minor footnote.
Travelers benefit from the holiday.com eSIM, but only on annual or two-year terms, and only for a fixed number of days: three on Advanced, five on Express Pro. A monthly subscriber on either tier receives nothing from this benefit.
macOS and Linux users are served by some of the most confidently current evidence in the entire product: split tunneling on macOS 11 and later, and a deep, current Linux CLI feature set.
Household router users have a real use case in Aircove and Aircove Go, but reliability evidence is limited to individual reviewer observations, and the hardware depends on an active subscription for full function. No broader pattern, positive or negative, is established.
Business users are served by Teams, a separate product with its own licensing that sits outside the consumer bundle this article covers.
No segment here should be read as receiving a complete or best experience. The evidence supports relative differences between segments, not a ranking against competing products.
Where the suite remains uneven
Several open items affect subscribers directly enough to name plainly, rather than bury in a list of minor caveats.
The Basic tier’s adult site blocking contradiction is the clearest example: ExpressVPN’s own documentation disagrees with itself, and no tie-breaking source resolves it. It should be treated as unresolved, not assumed either way.
Identity Defender’s U.S.-only availability and the term-dependent unlocking of both Identity Defender and the eSIM benefit on Advanced plans are confirmed limitations, not evidence gaps. A subscriber choosing between monthly and annual terms, or deciding whether a higher tier is worth it outside the U.S., is making that decision against real, documented restrictions.
Several other questions remain genuinely open rather than resolved in either direction. Full iOS, television, browser-extension, and Lightway Turbo parity is not documented in enough detail to state a position. What happens to ExpressKeys data, MailGuard aliases, or Identity Defender history after a downgrade or cancellation is not addressed in current documentation. The migration and reversibility rules for subscribers grandfathered onto the pre-tier plan are likewise undocumented. None of these gaps should be read as evidence of a problem; they should be read as questions current public material does not answer.
Editor’s note: A federal case, Millar v. Express Technologies Ltd., addresses auto-renewal allegations; some claims were dismissed or compelled to arbitration while another continued, and no liability finding has been made. This is a verified procedural fact, not evidence of billing misconduct.
The bigger picture
The core VPN is mature. The wider platform is still proving that more products add up to more value.
ExpressVPN’s VPN infrastructure has a long track record and current, verifiable technical documentation behind it. The password manager, the identity tool, the AI feature, the email relay service, and the router hardware around it are newer, delivered separately, gated by plan and term, and in one case restricted to a single country.
That contrast is not a flaw in the newer products so much as a description of where each part of the offering currently stands.
What decides whether this pays off
The open question is whether the newer suite becomes integrated, useful, and globally relevant enough to justify ExpressVPN’s move beyond the VPN. That depends on things current evidence does not yet settle: whether the products behind one dashboard ever share more than a bill, whether Identity Defender reaches subscribers outside the U.S., whether the newer tools see meaningful use once the audits are behind them, and whether switching or downgrading between plans turns out to be simple or costly.
None of that is predictable from what exists today. It is worth watching, not forecasting. For now, the VPN remains the reason to subscribe. The wider bundle is the part ExpressVPN still has to prove.