Like most apps of its kind, Keys lets you autofill logins, passwords, credit/debit card data, or store other private info. It also lets you generate secure passwords, can act as an authenticator app for 2FA systems, and even includes a data breach checker for your keys and personal data.
In this guide, we explore every aspect of ExpressVPN Keys in great detail. We look at pricing, security, and offer quick guides for each feature. Lastly, we provide some alternatives to ExpressVPN Keys, tips to improve your online security, and go over our testing methodology.
ExpressVPN Keys review summary
ExpressVPN Keys has everything you’d need out of a password manager. It’s secured with powerful AES 256-bit encryption, and is included for free with ExpressVPN. However, it currently lacks Firefox/Safari support and a password-sharing feature. This may deter non-Chromium browser users or those hoping for a family-oriented password manager.
ExpressVPN Keys overview and features
ExpressVPN Keys comes free with any ExpressVPN subscription (starting at $8.32 / GBP £6.59 per month for the yearly plan). You can install ExpressVPN and use this feature on unlimited devices. Best part: you can continue using Keys even after canceling your VPN subscription, so no need to worry about losing access to your passwords.
Here’s what’s included with ExpressVPN Keys:
- Locally-stored primary password
- Unlimited storage for logins, passwords, payment details, and notes
- Autofill login info, passwords, card details
- Biometric authentication on iOS and Android
- Customizable password generator
- Password health checker
- Data breach checker for passwords and personal info
- Usable as two-factor authentication (2FA) system with TOTP
- Sync across all devices with no limits
- Offline editing of login info and other data
- Easy importing and exporting (for supported apps)
- Zero-knowledge framework
- Highly secure 256-bit AES encryption
- 2FA requirement for new devices
- 24/7 live support via live chat
- Fully-featured VPN
ExpressVPN Keys pricing
ExpressVPN Keys has no standalone version and is not a paid add-on. It is included when you sign up for ExpressVPN at no extra cost. The VPN itself has three subscription tiers, with decent savings on longer plans:
- 1 month: $12.95 (GBP £10.26) per month
- 6 months: $9.99 (GBP £7.91) per month
- 12 months: $8.32 (GBP £6.59) per month
How does this compare to some top competitors? Well, Dashlane costs $7.49 (GBP £5.93) per month, billed annually at $89.99 (GBP £71.27), while Sticky Password is a more budget-friendly option at only $19.99 (GBP £15.83) for 1 year.
Of course, you could always just sign up for a month of ExpressVPN and not renew your subscription. You won’t lose access to the Keys password manager, which is a pretty sweet deal. That said, the VPN is a big plus to security (and streaming), so it would be sorely missed.
Dashlane’s VPN solution is much more limited in scope, while Sticky Password doesn’t include one at all. A fairer comparison would be with NordVPN Plus, which has both at $13.99 (GBP £11.06) per month. In the end, which one you go with depends on your personal needs.
ExpressVPN Keys security
It can be a bit nerve-wracking to trust a company with all of your passwords. Fortunately, ExpressVPN has had a stellar reputation as a VPN provider for well over a decade now, and that extends to its password-managing service.
Let’s take a closer look at its security features.
High-level encryption
ExpressVPN Keys uses 256-bit AES encryption to secure your passwords, logins, payment data, and other personal info. Without getting too technical, AES-256 is used to secure top-secret information by the US government agencies, such as the NSA.
Moreover, the provider uses so-called zero-knowledge encryption. As a result, it doesn’t have access to any of your stored information, nor your primary password or recovery code. Best of all, no cyber attacker can intercept your online communications to decrypt them later, as everything happens locally on your device.
Account recovery
We should preface that ExpressVPN’s zero-knowledge architecture won’t allow you to recover your stored logins if you lose your primary password and your recovery code. However, ExpressVPN support can still reset your password manager account so you don’t have to create a new one. Store your recovery code in a secure place to avoid any headaches.
Additional verification
ExpressVPN Keys lets you enable two-factor authentication (2FA) on compatible websites, through both the mobile apps and the browser extension. The app generates so-called time-based one-time passwords (TOTPs) that act as an additional verification step.
Otherwise, ExpressVPN Keys itself will require a 2FA code for every device you link after the first one. This is to ensure nobody can gain access to your passwords, even if they happen to catch a glimpse of your primary password or recovery code.
Auto-lock is available in case you’re on a shared mobile device and want to sign out of the app after a while (up to 30 minutes). Finally, you can enable biometric unlocking through ExpressVPN’s iOS and Android apps.
VPN included with subscription
ExpressVPN is a top-rated VPN that can mask your online activity against ISP data logging, mass surveillance, and keep you protected on unsecure networks (such as public wi-fi). It has a fully audited no-logs policy to maintain your privacy, and all of its 3,000+ servers in 105 countries feature obfuscation to mask VPN usage.
All in all, it’s a solid choice for privacy-conscious users, and comes packaged with ExpressVPN Keys. If you happen to cancel your VPN subscription at any point, you can continue using the password manager with zero issues.
Independently audited
ExpressVPN regularly undergoes third-party audits of its services. That includes its password manager, which has been audited by Cure53. ExpressVPN has consistently proven its high standards for privacy and security.
How to set up ExpressVPN Keys
Setting up and using this password manager is fairly simple. First things first: sign up for ExpressVPN and download the desktop and/or mobile apps. Once you’ve activated your account, proceed to the guides below.
How to set up the ExpressVPN Keys mobile apps
Once you download and launch the ExpressVPN app from the App Store or Google Play Store, tap on the Keys tab. Press Skip, as you’re not missing more than a little overview of the password manager’s features. Then, tap Set Up ExpressVPN Keys to continue.
Now it’s time to set your primary password, receive your recovery code, and verify your account. Choose a hard to guess, but memorable passphrase as your primary password, so you don’t get locked out. You can use our password strength tool to test it out beforehand.
Tap Set Primary Password, then either write down your recovery code or save it as a PDF to store securely elsewhere. Press Continue and you’ll receive a 6-digit code in the email you used to sign up with. Type it in, then tap Enter Code to finish up.
You can enable Auto-lock upon exiting. Go to Options > Other Settings > Security.
From here, find Auto-lock when leaving the app and select Immediately. Now, whenever you exit the app, anyone attempting to access your sensitive data will need to know the primary password or recovery code.
How to set up the ExpressVPN Keys browser extension
After setting up and activating the VPN on your machine, download the ExpressVPN browser extension from the Chrome Web Store. This works with other Chromium-based browsers like Opera, Vivaldi, Brave, even Edge.
On a related note, we’ve spoken to the ExpressVPN team about a potential extension for Firefox or Safari, and they’ve mentioned adding it to the feature request list. We hope to see a release soon, and we’ll update the guide with all the relevant info.
Moving on, click Add extension to confirm installation. You’ll be redirected to the screen below. Once again, click Skip.
Afterwards, click on “Set Up ExpressVPN Keys” to proceed.
If you’ve already set up your primary password and gotten your recovery code through the mobile app, you’re basically set. Otherwise, follow the same steps – choose a strong password, store your recovery code somewhere safe, and finish up.
Auto-lock can be customized much like in the mobile app. Click on the extension icon in your browser, then go to Options > Settings > Auto-lock settings. Here you can adjust the time before auto-lock activates after the system has been left idle.
ExpressVPN Keys features review
ExpressVPN Keys has a good set of features for being a free add-on to a VPN. Here’s everything you need to know:
Adding passwords
Once you’re set up and signed in, you’ll want to build your password library. The process is similar across the mobile apps and browser extension, with some minor differences.
Through the browser extension
Just click Add your first item (or +) > Add New Login and add the service’s name, your email, password, and the site URL. You can add an optional note or enable 2FA as well. More on that in a later section. For now, just click Save, and you’re done.
If you’ve been using your browser’s built-in password manager, there’s a more practical way of adding single passwords to Keys. Simply visit the website you want, click on the red key sign next to your login, then Add login to ExpressVPN Keys.
The extension will prompt you to save the login. Edit the name if you wish, then click Save.
In my case, when I clicked the red key icon, my ProtonMail login details were already saved. Whenever you click the symbol, you can choose from any of your saved accounts, and Keys will automatically fill in your username/email and password. That’s Autofill on desktop, in a nutshell.
Through the mobile apps
On mobile you can select from a list of pre-determined services like Amazon, Facebook, Netflix, and more, which is pretty convenient. Or, you can just tap to Enter login details manually and fill out the info that way.
Any passwords you add are correctly synced across clients, as I discovered soon after adding my ProtonMail account through the browser extension.
Importing and exporting passwords
It’s relatively easy to import passwords from supported apps (like Chrome/similar browsers, Safari/iCloud, Dashlane, 1Password, and other popular password managers). All you need to do is export a CSV file from your chosen pass manager and import it via ExpressVPN Keys.
Note that currently unsupported browsers (Firefox and Safari, notably) require a bit of spreadsheet editing, though nothing too egregious. Still, it’s worth mentioning, and we hope ExpressVPN fixes this in the future.
Anyway, let’s import some passwords.
Importing through the extension
Click on the Keys extension icon, then click Options > Settings > Import from existing services to get started.
A new tab will open, where you can select which service you wish to import from. Clicking on any of them will open a set of instructions on how to export passwords for that specific service in CSV format. You can use this CSV file to import your passwords to ExpressVPN Keys.
I used Opera for this, which runs on Chromium. As such, I only had to delete an extra “note” column in the password CSV file. Whichever password manager you use, you’ll see a Choose File button at the bottom of the instructions. Click it, then choose your CSV file.
If everything goes well, all your logins should be imported successfully. You can close the tab or import more logins from a different password manager/browser if you so choose.
Importing in the mobile app
Importing passwords through the mobile app is only possible with Chrome, Brave, and Vivaldi, which is pretty limiting. ExpressVPN Keys even lets you know that importing from other apps requires using your computer.
Once again, tap Options > Other Settings > Data to get to the desired settings page.
Afterwards, select Import from existing services, pick Chrome/Brave/Vivaldi, and follow the instructions on the screen. That’s it!
To import from other password managers or browsers, please consult the previous section. Fortunately, ExpressVPN makes handy guides for that.
Exporting passwords from ExpressVPN Keys
To export your passwords from Keys into a CSV file, do the following:
- Browser extension: Options > Settings > Export data as CSV > enter your primary password to start your download.
- Mobile app: Options > Other Settings > Data > Export data as a CSV file > Export Password Data > input your main password.
One thing to note is that I couldn’t find the option to download the CSV file locally on my Android device, so I had to upload it to my Google Drive account. Make sure you have a secure way to store your password CSV file before exporting.
Now, since the Autofill feature has been poking me for a while, let’s enable it for convenience.
Auto filling passwords
We’ve already seen the browser extension Autofill in action earlier (the red key sign method), so now we’ll cover the mobile version. Here’s how to enable it:
- On Android devices: Launch ExpressVPN and tap Options > Settings > Automatically fill login details. Then simply follow the instructions on screen to enable Autofill.
- On iOS: Go to your device Settings > Passwords > AutoFill Passwords and tap to disable iCloud Keychain. Then, enable ExpressVPN instead.
Sure enough, I got the suggested logins above my keyboard when I tapped the email field. I also tested this on geo-blocked services like ITVX and BBC iPlayer while connected to ExpressVPN, to see how the two features performed together. Everything worked as intended.
I also tried accessing my PayPal account through the app to see how Keys would react. For context, I have SMS-based 2FA enabled on PayPal. Well, ExpressVPN Keys offered to autofill any codes I receive, which I found pretty neat.
Shame I didn’t see this advertised anywhere (feel free to prove me wrong in the comments!)
Password generation
Like most password managers nowadays, ExpressVPN has a generator tool to help you create strong passwords for all your accounts.
You can use the feature when adding new accounts by clicking or tapping “Need a new password?” or editing old ones by selecting Generate Strong Password.
On mobile, you can also tap the green + sign then Generate Password for the same effect.
Whichever route you go, you have a few options to customize your password:
- Capitals
- Numbers
- Symbols
Add or remove any of these characters, then use the slider to choose your preferred password length. Click Use Password to input it into its respective field then click to Save your changes. Naturally, resetting your account passwords is still done manually through the service’s main website, but at least Keys helps you automate a part of the process.
Now, you may have spotted that I have two exposed passwords according to ExpressVPN Keys. This is a good chance to show off the mobile-only Data breach alerts feature.
Data breach alerts
ExpressVPN Keys uses the helpful HaveIBeenPwned database to notify you whether one of your passwords has been exposed in a data breach. None of your passwords, your IP, or any other personal data is ever sent to HaveIBeenPwned in the process.
Why is this feature important? Well, cyber attackers use automation to try out all these exposed passwords with a large volume of accounts on different services, hoping some of them will work. It’s great to have a little heads-up on the matter.
Tap on the Exposed Passwords notification at the top of the Keys app to fix any issues.
As you can see, my Disney Plus and Shudder accounts have weak passwords that were involved in a data breach. Tapping on either of them, then Help Me Fix > Go to Website redirects me to the service, allowing me to reset my password. You can then return to Keys and save your new login.
The setting is enabled by default, but you can disable it under Options > Other Settings > Privacy by toggling off Data Breach Alerts. It’s a convenient feature, but you could just as easily visit HaveIBeenPwned yourself and check for data breaches without ExpressVPN.
You can turn it off if you’ve been diligent with using the password generator for stronger keys. If you have, the built-in password health checker will score you on a job well done.
Password health checker
Similar feature to those offered by other password managers, such as Dashlane, Sticky Passwords, and LastPass. Tap on the score circle at the top of the screen to get details about what you can improve.
The health checker gives you a detailed report of any:
- Reused or weak passwords
- Passwords exposed in data breaches
- Accounts made on unsecure URLs (starting with HTTP instead of HTTPS)
- Compatible sites on which you haven’t enabled 2FA
You can tap on any of the issues, which will take you to a list of vulnerable passwords, websites not covered by 2FA, and so on. Following the thread to any of these sites will let you use the Help Me Fix function, which I’ve covered in the data breach alerts section.
While we’re on the topic of 2FA, let’s see how ExpressVPN Keys handles it.
Adding 2FA to services
Much like Authy and similar apps, ExpressVPN Keys can generate TOTPs (time-based one-time passwords) as a 2FA measure — provided you have 2FA enabled on that site, that is. It’s a good idea to do so, as it can prevent hackers from accessing your accounts even if they have your primary password.
Before moving on:
- Ensure you’re logged into your preferred account.
- Open the 2FA settings (usually located in Privacy and Security).
- Click to enable 2FA to have your setup key or QR code ready.
- If you’re going the QR code route, make sure the website is opened on a different device than the one you’ve installed ExpressVPN Keys on.
How to enable 2FA through the ExpressVPN Keys extension
The process is similar whether you’re adding 2FA to a new login or an existing one. So click the green + then Add New Login or click one of your accounts and Edit Login Details to proceed. In both cases, you’ll see the Set Up 2FA Verification Code button.
Enter the setup key into ExpressVPN Keys and click Confirm. In my case, Proton asked for a 6-digit verification code, which I could easily copy and paste from Keys with the little copy icon. Convenient.
How to enable 2FA through the ExpressVPN Keys mobile app
Once again, add a new login or edit an old one, and press Set Up 2FA Verification Code. Tap Continue, enable 2FA on your chosen account, and enter the setup key or press Scan QR code instead. I decided to test the QR code method this time, and it was very responsive.
Finally, add your verification code into your app or website and you’re done. Tap Close and Save to finish.
Other features
- Adding secure notes and debit/credit cards: Works exactly like adding passwords. Besides autofilling credit card info, Keys is useful for storing private info (e.g. passport, medical, insurance-related, alarm codes, etc.) in an encrypted format.
- Unlock with biometrics: Mobile-only. Can be activated by going to Options > Other Settings > Security and toggling on Unlock with biometrics. Works as expected.
- Offline access: You can store and edit logins, passwords, credit card info, and more for later use, even if the wi-fi’s down or your mobile connection is being finicky.
Is ExpressVPN Keys worth using?
ExpressVPN Keys is a great password manager overall, especially considering it’s built into one of our top-rated VPN apps. Here are some pros and cons to help you decide if it’s worth using.
The benefits of ExpressVPN Keys
Being a free add-on to one of the best VPNs out there is a perk, but we also like the fact that you don’t need to maintain your subscription to keep the password manager functionality. As a standalone product, ExpressVPN Keys lets you autofill passwords and debit/credit card details, generate strong passwords, and store all of this info (plus notes) securely.
It’s usable on unlimited devices, automatically syncs your data, offers biometric unlock and 2FA (on top of acting as an authenticator app). Its password health checker and data breach alerts are also useful for anyone looking to spruce up their accounts with uncrackable passwords.
Downsides to ExpressVPN Keys
The downsides to ExpressVPN Keys range from mere nitpicks to real deterrents for some groups of users. Here’s what to look out for:
- Missing favicons for most websites: Outside major services like PayPal, Netflix, and others, most sites have a green icon derived from the first two letters of their title. My list was basically filled with “AU” and “WW” after importing my passwords, which is a little disappointing since other managers automatically add the correct favicon.
- No address or contact info autofill: More of a feature request than anything, the ability to fill out long addresses and contact details would be appreciated. For example, 1Password offers address autofill, so we hope to see it in Keys as well.
- Hardware token/passkey authentication for enhanced security would be great, though we understand most apps and websites don’t support this yet.
- No shared passwords or profiles: If you’re looking for an app to manage passwords for the whole family, ExpressVPN Keys isn’t there yet.
- Lacks support for some major browsers: ExpressVPN Keys does not have a Firefox or Safari extension (yet), and importing passwords can be a tad annoying with unsupported apps, requiring you to edit CSV files manually.
ExpressVPN Keys review verdict
ExpressVPN Keys holds a lot of promise, but it still needs a few extra features and fixes to be considered among the top competitors — extended browser support and reliable password sharing, in particular. Otherwise, it’s a solid two-in-one solution for personal online security, with seamless integration of essential security features and functionality.
Alternatives to ExpressVPN Keys
If you’d rather have a standalone password manager or you’re deterred by some of the downsides of ExpressVPN Keys, here are some extra options you can try:
- Dashlane
- Sticky Password
- LastPass
- NordPass (or NordVPN Plus)
- RememBear
- Password Manager Pro
- 1Password
- KeePass
How to improve your online security further
Getting a reliable password manager is a good first step towards improving your cyber security. However, your efforts shouldn’t end there. Here are some other useful ways you can boost your online security:
- Set up two-factor authentication (2FA).
- Install a VPN (already there with Keys).
- Use an antivirus to keep malware at bay.
- Consider setting up a third-party firewall.
Methodology: How we tested ExpressVPN Keys
To get the true ExpressVPN Keys experience down, we took a first-hand approach to testing the app and its extensions. We wanted to see how it works from a regular user’s perspective, instead of mirroring what’s been said on other review sites.
As such, we personally used every single feature of the password manager and explored what makes it different from similar tools we’ve tested. Our tests focused on the app’s features, its effectiveness, and how trustworthy the provider is. Here’s a summary of our methods.
Features
Normally, we’d look at features included in the free and premium plans of a password manager. Because there’s no free version of ExpressVPN Keys, we simply used all of its options as any normal user would. We then compared it to other password managing apps, making note of any important missing features and what we’d like to see in future updates.
Effectiveness
We tested how effective ExpressVPN Keys is at securing your passwords and other sensitive data. This implies checking the provider’s encryption algorithm, architecture (see: zero-knowledge encryption), and whether two-factor and biometric authentication is available. We also measured how easy it is to use each feature and whether they worked as advertised.
Trustworthiness
Pretty straightforward: we assessed the provider’s trustworthiness by looking at their pricing transparency, terms of service, privacy policy, and whether its services have undergone successful independent audits. We also checked if customer support reps respond promptly and if they offer helpful solutions rather than copy-pasted answers that don’t lead anywhere.
Here is a full description of our testing methodology for password managers.