ExpressVPN
ExpressVPN is a paid VPN that encrypts your internet connection and replaces your public IP address with a VPN server’s address. It’s made by Express Technologies, based in British Virgin Islands.
Criminals have used its name in fake downloads or scams, so get it only from expressvpn.com.
What it is
People use ExpressVPN for privacy on shared Wi-Fi and to connect through servers in other countries. It requires a subscription.
It routes your Mac’s internet traffic through its servers. The website version installs a helper tool with your administrator password. Its optional split tunnelling feature needs a network extension to send selected apps outside the VPN.
ExpressVPN is an established service with published outside security audits. Its privacy policy says it does not record browsing history, traffic destinations or DNS requests. It collects account details and some usage statistics. Sending diagnostic reports is optional.
Who makes it
Express Technologies operates ExpressVPN, a VPN service launched in 2009 and owned by Kape Technologies. Its legal name is Express Technologies Ltd.. Its website is expressvpn.com.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of ExpressVPN. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is com.expressvpn.ExpressVPN or com.express.vpn. Download it only from expressvpn.com or the Mac App Store, not from an ad or a link someone sends you.
Fakes. In October 2023, Cyble reported a fake ExpressVPN download website used to deliver the RMS remote administration tool to Windows users.
What it connects to
In normal use, ExpressVPN talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
api.expressvpn.com | Account authentication and service configuration. |
cp.expressapisv2.net | VPN service API. |
api.jwks.kape.com | Public keys for checking authentication tokens. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| VPN | Allows the app to configure and manage the VPN connection. |
| Network Extensions | The optional split tunnelling feature needs its network extension and proxy configuration approved. |
Security record
Problems with ExpressVPN or Express Technologies in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| ExpressVPN disclosed a Windows flaw that could expose a user’s real IP address through traffic on TCP port 3389; it was fixed in version 12.101.0.45. | ↗ | |
| ExpressVPN said the TunnelVision network attack could bypass its Mac VPN if the kill switch was manually disabled; its tests found no leaks with the default kill switch enabled. | ↗ | |
| ExpressVPN fixed Windows split tunnelling flaws that could send website address lookups outside the VPN, and an outside audit subsequently checked the fixes. | ↗ |
References
- App Catalog: ExpressVPN bundle identifier appcatalog.cloud
- Fleet software catalogue: ExpressVPN application identifiers fleetdm.com
- ExpressVPN Privacy Policy expressvpn.com
- About ExpressVPN expressvpn.com
- ExpressVPN for Mac expressvpn.com
- How to set up and use ExpressVPN on macOS expressvpn.com
- How to download and update ExpressVPN expressvpn.com
- ExpressVPN Mac release notes expressvpn.com
- ExpressVPN on the Mac App Store apps.apple.com
- ExpressVPN Trust Center expressvpn.com
- ExpressVPN bug bounty programme: production API domains yeswehack.com
- Cyble: phishing campaign impersonating ExpressVPN cyble.com
- ExpressVPN: Windows remote desktop traffic leak fixed expressvpn.com
- ExpressVPN: TunnelVision assessment expressvpn.com
- ExpressVPN: Windows split tunnelling fixes expressvpn.com