Like most password managers, Keys lets you autofill logins, passwords, and credit or debit card details, as well as store other private information. It also includes a secure password generator, can function as an authenticator app for 2FA systems, and offers tools to identify weak, reused, or exposed passwords.
In this guide, I explore every aspect of ExpressVPN Keys in detail. I look at pricing and security, walk through each core feature, and compare it with alternative password managers. Finally, I share practical tips to improve online security and explain the testing methodology behind my review.
ExpressVPN Keys review summary
ExpressVPN Keys has most of the features you’d expect from a modern password manager. It’s protected using zero-knowledge encryption with strong AES-256 security and is included with eligible ExpressVPN plans, making it a convenient option for existing subscribers.
While it doesn’t currently offer a native desktop app or password-sharing features, it does support desktop use through browser extensions for Chrome, Safari, and Edge. The lack of Firefox support and family-style sharing tools may deter some users, but for individuals who want a straightforward, privacy-focused password manager that integrates closely with ExpressVPN’s ecosystem, Keys remains an effective option.
ExpressVPN Keys overview and features
ExpressVPN Keys is included with ExpressVPN Advanced and Pro plans, but it is not available on the Basic tier. Pricing for eligible plans currently starts at $4.49 per month when you opt for a two-year Advanced subscription, with higher prices for shorter terms or the Pro plan. You can install ExpressVPN Keys on an unlimited number of devices, and importantly, you retain access to your saved passwords even if you later cancel your VPN subscription.
ExpressVPN Keys is now available as a dedicated app for Android and iOS, rather than being built directly into the VPN app. On desktop, password management is handled through browser extensions for Chrome, Edge, and Safari on Windows and macOS. Because the extension is Chromium-based, it may also work in other Chromium browsers, though ExpressVPN only officially supports the browsers listed above. As with any password manager, it’s a good idea to disable your browser’s built-in password to avoid conflicts.
Here’s what’s included with ExpressVPN Keys:
- A locally secured primary password
- Unlimited storage for logins, passwords, payment details, and secure notes
- Autofill for login credentials and card details
- Biometric authentication on iOS and Android
- A customizable password generator
- Password health tools to identify weak or reused passwords
- Data breach monitoring for passwords and personal details
- Built-in two-factor authentication (TOTP) support
- Automatic syncing across an unlimited number of devices
- Offline access and editing of stored items
- Import and export support for switching from other password managers
- A zero-knowledge security framework
- Strong 256-bit AES encryption
- Two-factor authentication when signing in on a new device
- 24/7 live chat support
ExpressVPN Keys pricing
ExpressVPN Keys does not have a standalone version and is not sold as a separate add-on. Instead, it is bundled with ExpressVPN Advanced and Pro plans. It is not available on the Basic tier, which is intended for users who only want the VPN.
At the time of writing, pricing for plans that include ExpressVPN Keys looks like this:
ExpressVPN Advanced (includes Keys)
- 2 years: $4.49 per month
- 1 year: $5.99 per month
- 1 month: $13.99 per month
ExpressVPN Pro (includes Keys)
- 2 years: $7.49 per month
- 1 year: $8.99 per month
- 1 month: $19.99 per month
Existing ExpressVPN subscribers have already been upgraded to the Advanced plan at no extra cost. This means current users do not need to pay more to keep using the password vault and can access ExpressVPN Keys, including the standalone password manager app, for the remainder of their existing subscription period.
How does ExpressKeys pricing compare?
Compared to standalone password managers, this pricing is competitive if you already want a VPN. For example, Dashlane costs $7.49 per month when billed annually, while Sticky Password is a more budget-friendly option at $19.99 per year, but does not include a VPN.
One advantage of ExpressVPN is that users are not immediately locked out of their stored passwords if they cancel their VPN subscription, which can help reduce the risk of losing access to their vault. However, ExpressVPN does not guarantee ongoing access, syncing, or feature availability after a subscription ends, and policies may change over time. That said, the VPN itself adds meaningful security and streaming benefits, which many users would likely miss.
Dashlane’s bundled VPN is far more limited in scope, while Sticky Password does not include a VPN at all. A closer comparison is NordVPN Plus, which bundles a VPN and password manager at $13.99 per month. Ultimately, the better option depends on whether you want an all-in-one privacy bundle or a standalone password manager with broader platform support.
If you can’t afford ExpressVPN Advanced or above but still need both a VPN and a password manager, Proton Pass is well worth considering, as it offers unlimited password storage for free with strong privacy protections and open-source apps.
ExpressVPN Keys security
A password manager is only as trustworthy as the company behind it. ExpressVPN already has a long-standing reputation as a privacy-focused VPN provider, and that same security-first approach applies to ExpressVPN Keys.
Below is a closer look at how ExpressVPN Keys protects your data.
High-level encryption
ExpressVPN Keys uses 256-bit AES encryption to secure passwords, logins, payment details, and other sensitive information. AES-256 is widely used across the security industry and is considered a strong standard for protecting confidential data.
The service also uses a zero-knowledge encryption model. This means ExpressVPN does not have access to your stored data, your primary password, or your recovery code. Encryption and decryption happen locally on your device, so stored information remains inaccessible to third parties without your primary password.
Account recovery
Because of its zero-knowledge design, ExpressVPN cannot recover your stored logins if you lose both your primary password and recovery code. However, ExpressVPN support can reset your password manager account if needed, although this won’t restore access to any previously stored data. For this reason, it’s important to store your recovery code securely to avoid losing access to your vault.
Additional verification
ExpressVPN Keys lets you enable two-factor authentication (2FA) on compatible websites through both its mobile apps and browser extensions. The app generates time-based one-time passwords (TOTPs), which act as an additional verification step.
Otherwise, ExpressVPN Keys itself will require a 2FA code for every device you link after the first one. This helps prevent unauthorized access if someone attempts to sign in from a new device, even if your primary password is compromised.
Auto-lock is available in case you’re on a shared mobile device and want to sign out of the app after a while (up to 30 minutes). Finally, you can enable biometric unlocking through the iOS and Android apps.
VPN included with subscription
ExpressVPN is a top-rated VPN that helps protect your online activity from tracking by ISPs and secures your connection on untrusted networks, such as public wifi. It has a fully audited no-logs policy, and when using the OpenVPN protocol, traffic is automatically obfuscated to make VPN usage harder to detect on restrictive networks.
What really sets ExpressVPN apart now is the strength of its Advanced and Pro bundles. In addition to the VPN itself, these plans include ExpressVPN Keys for password management, Advanced Protection for DNS-based tracker and malware blocking, and region-specific tools like Identity Defender. The Pro plan goes further by adding a Dedicated IP, along with newer privacy tools such as ExpressAI and ExpressMailGuard (which lets you forward an unlimited number of aliases to existing email services like Gmail).
Taken together, these extras significantly expand what you get beyond a standard VPN. Rather than padding the bundle with minor add-ons, ExpressVPN focuses on tools that meaningfully improve online privacy, account security, and day-to-day protection, making the higher-tier plans especially strong value for users who want more than just a basic VPN.
Independently audited
ExpressVPN regularly undergoes independent, third-party audits of its services, including ExpressVPN Keys, which has been audited by Cure53.
These audits mean you don’t have to take ExpressVPN’s privacy and security claims on trust alone. They also show an ongoing commitment to reviewing, validating, and, where necessary, improving its apps to ensure they remain resilient against evolving security threats.
How to set up ExpressVPN Keys
ExpressVPN Keys was previously available directly inside the ExpressVPN mobile apps. However, this is no longer the case. ExpressVPN has now moved Keys into a dedicated standalone app, and from March 5, 2026, the password manager will be removed entirely from the ExpressVPN app. To continue using ExpressVPN Keys, you must install the standalone app on mobile and the browser extension on desktop.
If you haven’t yet got a subscription, the first step will be to sign up for ExpressVPN Advanced or above. Once you’ve activated your VPN account, proceed to the guides below.
How to install ExpressVPN Keys
- On iOS: Download ExpressVPN Keys from the Apple App Store.
- On Android: Download ExpressVPN Keys from the Google Play Store.
- On desktop: Install the ExpressVPN Keys extension from the Chrome Web Store (supported on Chrome, Edge, and Safari).
Please Note: Although the password manager is branded as ExpressVPN Keys in documentation, you’ll need to search for “ExpressKeys Password Manager” in the Apple App Store or Google Play to find the correct standalone app.
Once installed, sign in using your ExpressVPN account credentials. Existing users will find their saved passwords, notes, and payment details already synced to the new app.
Initial setup
When you launch the ExpressKeys App, you will receive a message that asks you to go to your associated email account to enter a six-digit code (this is the email you used to sign up for ExpressVPN Advanced or above). Enter this code to sign in for the first time.
After signing in, you’ll be prompted to set a primary password. Choose a strong but memorable passphrase, as this password cannot be recovered by ExpressVPN.
You’ll also be given a recovery code, which should be stored securely offline.
Tap Set Primary Password, then either write down your recovery code or save it somewhere safe.
Next, you will be prompted to enable biometric unlock. This is a useful feature that makes it far easier to log in to ExpressKeys and use the autofill function on your mobile device:
Securing the app
ExpressVPN Keys automatically locks the app when it’s not in use. I recommend leaving this enabled, as it helps prevent anyone from accessing your passwords if you step away from your device, even briefly.
If you want to change the auto-lock behavior (set to five minutes by default), tap the profile icon in the bottom-left corner, then scroll to Password Manager Settings > Auto-Lock. From here, you can choose how quickly the app locks, including immediately when you exit.
With auto-lock enabled, anyone attempting to access your vault will need your primary password or biometric authentication, which adds an extra layer of protection if your device is lost or shared.
How to set up the ExpressVPN Keys browser extension
To use ExpressVPN Keys on desktop, install the browser extension from the Chrome Web Store. The extension is officially supported on Chrome, Edge, and Safari. While it may also work in other Chromium-based browsers, ExpressVPN only guarantees support for the browsers listed above.
Once installed, sign in using your ExpressVPN account credentials. If you’ve already set up your primary password and recovery code in the ExpressKeys mobile app, your vault will sync automatically to the browser extension.
Note that initial setup is handled through the mobile app, where you create your primary password and securely store your recovery code. For a smoother experience, I recommend installing the browser extension after completing setup in the mobile app.
The browser extension also includes auto-lock controls, similar to the mobile app. Click the extension icon, open Settings, and adjust how quickly the vault locks after inactivity. This helps prevent unauthorized access if you step away from your computer or share a device.
At the time of writing, ExpressVPN Keys does not offer a Firefox browser extension, which may be a limitation for users who prefer Mozilla’s ecosystem.
ExpressVPN Keys features review
ExpressVPN Keys offers a solid set of features as part of ExpressVPN’s Advanced and Pro bundles. Now that it’s available as a standalone password manager app, it covers the core functionality most users expect, including secure storage, autofill, and cross-device syncing.
Adding passwords
After completing initial setup in the ExpressKeys mobile app, you can start building your password vault. Adding logins works in a similar way across the mobile apps and the browser extension, with minor differences in layout.
Adding passwords through the browser extension
To add a login manually, open the browser extension, click the add (+) button, and select Add new login. From here, enter the service name, username or email address, password, and website URL. You can also add optional notes or enable two-factor authentication where supported. Once finished, click Save.
If you’re already signing in to a website, ExpressVPN Keys can also prompt you to save credentials automatically. When a login form is detected, you’ll see the ExpressKeys icon appear next to the fields, allowing you to save the login with a single click.
Once saved, clicking the ExpressKeys icon on supported sites lets you choose from your stored accounts. The extension will automatically fill in your username or email address and password, which is how autofill works on desktop.
Through the mobile apps
On mobile, tap the big green button in the top right corner to enter login details manually and fill out the information yourself.
Any passwords you add sync automatically across devices, whether they’re saved on mobile or through the browser extension.
Importing and exporting passwords
It’s relatively easy to import passwords from supported apps (like Chrome/similar browsers, Safari/iCloud, Dashlane, 1Password, and other popular password managers). All you need to do is export a CSV file from your chosen password manager and import it via ExpressVPN Keys.
Note that currently unsupported browsers (Firefox notably) require a bit of spreadsheet editing, though nothing too egregious. Still, it’s worth mentioning, and we hope ExpressVPN fixes this in the future.
Anyway, let’s import some passwords.
Importing through the extension
Click on the Keys extension icon, then click Options > Settings > Import from existing services to get started.
A new tab will open, where you can select which service you wish to import from. Clicking on any of them will open a set of instructions on how to export passwords for that specific service in CSV format. You can use this CSV file to import your passwords to ExpressVPN Keys.
Whichever password manager you use, you’ll see a Choose File button at the bottom of the instructions. Click it, then choose your CSV file.
If everything goes well, all your logins should be imported successfully. You can close the tab or import more logins from a different password manager/browser if you so choose.
Importing in the mobile app
The ExpressKeys mobile app includes an import option, allowing you to bring in passwords from supported sources directly on your phone.
That said, importing via the desktop browser extension offers broader compatibility, especially when migrating from dedicated password managers or less common browsers.
For larger or more complex migrations, ExpressVPN recommends using the desktop extension and importing via CSV. Once imported, all passwords sync automatically to the ExpressKeys mobile app.
Exporting passwords from ExpressVPN Keys
To export your passwords from Keys into a CSV file, do the following:
- Browser extension: Options > Settings > Export data as CSV > enter your primary password to start your download.
- Mobile app: Options > Other Settings > Data > Export data as a CSV file > Export Password Data > input your main password.
One thing to note is that I couldn’t find the option to download the CSV file locally on my Android device, so I had to save it using a secure file storage option. Make sure you have a secure way to store your password CSV file before exporting.
Now, since the Autofill feature has been poking me for a while, let’s enable it for convenience.
Auto-filling passwords
ExpressVPN Keys supports autofill on both desktop (via the Chrome extension) and mobile. Here’s how to enable and use autofill on mobile devices.
On Android:
Open the ExpressKeys app, go to Settings, and enable autofill when prompted. Android will then ask you to select ExpressKeys as your default autofill service.
On iOS:
Go to Settings > Passwords > Password Options, then enable ExpressKeys under autofill providers. You can leave iCloud Keychain enabled if you wish, but only one password manager will actively offer autofill suggestions at a time.
Once enabled, saved logins appear above the keyboard when you tap into a username or email field, making sign-ins quick and seamless.
ExpressVPN Keys can also generate and autofill one-time passcodes for accounts that use app-based two-factor authentication (TOTP). During testing, this worked smoothly alongside standard login autofill and added a nice extra layer of convenience.
Password generation
If any of your passwords are weak, you will see a message above the entry in your vault that reads: Security issues detected Fix Now. You can resolve the weak password problem by clicking the fix now button.
You will now see a message asking you whether you want to fix the weak password or set up Two Factor Authentication (if you don’t have it enabled yet).
Clicking on an unsecured password prompts you to visit the relevant website so you can update it, then return to ExpressVPN Keys to save the new credentials.
You can follow that workflow if you like. However, I recommend using the built-in secure password generator in ExpressVPN Keys instead.
To do this, click Edit on the entry you want to update, then select Generate strong password beneath the existing password.
This will open the ExpressKeys generator, with a password already set for you:
If you want to customize the generated password, you can choose whether to include capital letters, numbers, and symbols. You can also adjust the password length using the slider.
Once you’re happy, click Use password to insert it into the field, then save your changes.
After generating a strong password, you can copy it and update the password directly on the relevant website (for example, Facebook), then return to ExpressKeys to store the new credentials. Doing it this way ensures your account is protected with a robust password.
Personally, I’d like to see ExpressKeys guide users toward this workflow by default, as it helps ensure the strongest possible password is used, rather than relying on users to make those choices within the account itself.
Data breach alerts
ExpressKeys also includes password health and breach monitoring. It flags weak, reused, or exposed passwords and prompts you to update them, without sending your passwords, IP address, or personal data to third-party services. This helps reduce the risk of credential-stuffing attacks, where leaked passwords are automatically tested across multiple accounts.
Password health checker
ExpressKeys includes a password health overview that brings together its security checks in one place. It highlights common risks such as weak or reused passwords, credentials exposed in known data breaches, logins on unsecured websites, and accounts that support two-factor authentication but don’t have it enabled.
Rather than treating these as separate features, the health overview acts as a summary layer that ties together breach alerts, password strength, and 2FA coverage. This makes it easier to spot and prioritize security issues without digging through individual entries.
Adding 2FA to services
Like dedicated authenticator apps such as Authy, ExpressVPN Keys can generate time-based one-time passwords (TOTP) for accounts that support app-based two-factor authentication. Enabling 2FA adds an important extra layer of protection, helping prevent account access even if a password is compromised.
You can set up 2FA for a new or existing login from either the browser extension or the mobile app. Once you enable 2FA on the service itself, ExpressVPN Keys lets you enter the setup key or scan a QR code to link the account. From that point on, Keys generates six-digit verification codes automatically and can autofill them during sign-in.
The process works smoothly on both desktop and mobile, and having password storage and 2FA codes in one place reduces the need for a separate authenticator app.
Other features
- Secure notes and payment details: In addition to passwords, ExpressKeys lets you store secure notes and credit or debit card details. These are encrypted in the same way as logins and can be autofilled where supported. Secure notes are useful for storing sensitive information such as passport details, insurance numbers, medical notes, or alarm codes.
- Biometric unlocking: Available on mobile devices, biometric unlocking allows you to access your vault using your fingerprint or face recognition. Once enabled in the app’s security settings, it works reliably and removes the need to enter your primary password each time.
- Offline access: ExpressKeys allows you to view and edit saved logins, passwords, payment details, and notes even when you’re offline. Any changes you make are synced once your device reconnects, which is handy if your wifi or mobile connection drops.
Is ExpressVPN Keys worth using?
ExpressVPN Keys is a strong password manager overall, particularly if you’re already using an ExpressVPN Advanced or Pro plan. Now that it’s available as a standalone app, it feels far more complete than the previous version that was embedded in the VPN app.
The benefits of ExpressVPN Keys
ExpressVPN Keys offers all the core features most people need from a password manager. It can securely store and autofill passwords and payment details, generate strong passwords, act as a built-in authenticator for app-based 2FA, and sync everything across an unlimited number of devices. Biometric unlocking on mobile works reliably, and the password health tools and breach alerts make it easier to identify and fix weak or exposed credentials.
As part of ExpressVPN’s broader Advanced and Pro bundles, Keys also benefits from being tightly integrated into a wider privacy ecosystem, which adds to its overall value if you want more than just a password manager.
Downsides to ExpressVPN Keys
There are still some limitations worth keeping in mind. Website favicons are missing for many services, which makes large vaults harder to scan visually compared to more mature managers. There’s no support for shared vaults or family password sharing, which rules it out for households. Address and contact autofill are also missing, and while passkeys and hardware token support would be welcome, these features are not yet widely supported across the web.
Browser support is another consideration. While ExpressVPN Keys works on Chrome, Edge, and Safari, there’s still no Firefox extension, which may be a deal-breaker for some users.
ExpressVPN Keys review verdict
ExpressVPN Keys has matured into a capable standalone password manager, but it’s best suited to individual users rather than families or power users. It covers the essentials well and integrates cleanly with ExpressVPN’s Advanced and Pro plans, making it a compelling option if you already want a premium VPN bundle. However, broader browser support and password sharing are still needed before it can compete head-to-head with the very top password managers.
Alternatives to ExpressVPN Keys
If you’d rather have a standalone password manager or you’re deterred by some of the downsides of ExpressVPN Keys, here are some extra options you can try:
- ProtonPass
- Dashlane
- Sticky Password
- LastPass
- NordPass (or NordVPN Plus)
- RememBear
- Password Manager Pro
- 1Password
- KeePass
How to improve your online security further
Getting a reliable password manager is a good first step towards improving your cyber security. However, your efforts shouldn’t end there. Here are some other useful ways you can boost your online security:
- Set up two-factor authentication (2FA).
- Install a VPN (already there with Keys).
- Use an antivirus to keep malware at bay.
- Consider setting up a third-party firewall.
Methodology: How we tested ExpressVPN Keys
To get the true ExpressVPN Keys experience down, I took a first-hand approach to testing the app and its extensions. I wanted to see how it works from a regular user’s perspective, instead of mirroring what’s been said on other review sites.
As such, I personally used every single feature of the password manager and explored what makes it different from similar tools we’ve tested. My tests focused on the app’s features, its effectiveness, and how trustworthy the provider is. Here’s a summary of my methods.
Features
Normally, I’d look at the features included in both free and premium plans. Since ExpressVPN Keys doesn’t offer a free version, I used all of its features as a regular user would. I then compared it with other password managers, noting any important gaps and areas where I’d like to see improvements in future updates.
Effectiveness
I tested how effective ExpressVPN Keys is at securing passwords and other sensitive data. This included examining its encryption, zero-knowledge architecture, and support for two-factor and biometric authentication. I also evaluated how easy each feature is to use and whether everything worked as advertised.
Trustworthiness
To assess trustworthiness, I reviewed ExpressVPN’s pricing transparency, terms of service, and privacy policy, along with the results of its independent security audits. I also considered my experience with customer support, paying attention to response times and whether the answers provided were genuinely helpful rather than generic or scripted.
Here is a full description of the testing methodology all Comparitech reviewers use for password managers.