Sourced comparison
ExpressVPN vs NordVPN: audits, owners and leak fixes
ExpressVPN and NordVPN side by side: who runs each, what independent auditors checked, and how each app handled the TunnelVision and TunnelCrack leaks. Every cell links its source. Last checked 28 Oct 2026.
Where ExpressVPN and NordVPN differ
- Who runs them. ExpressVPN is run by Express Technologies Ltd. in the British Virgin Islands, part of Kape Technologies; NordVPN by nordvpn S.A. in Panama, part of Nord Security.
- Audits. ExpressVPN lists 23 since 2019, the latest by Cure53 in Apr 2026; NordVPN lists 11 since 2018, the latest by Deloitte on 3 Feb 2026.
- Incidents. ExpressVPN has 1 on record, NordVPN has 2.
- TunnelVision. On Windows and Linux, ExpressVPN says mitigated and NordVPN says not affected; on iOS, ExpressVPN says affected and NordVPN says mitigated.
- TunnelCrack LocalNet. On macOS, ExpressVPN says not affected and NordVPN says mitigated.
The same on both: RAM-only servers: both state it on their own pages; open-source apps: both state it on their own pages; transparency: both publish a report or canary; TunnelCrack ServerIP: the same status on every app.
At a glance
| ExpressVPN | NordVPN | |
|---|---|---|
| Company and country | Express Technologies Ltd., British Virgin Islands SourceRead 18 Oct 2026 | nordvpn S.A., Panama SourceRead 26 Oct 2026 |
| Part of | Kape Technologies SourceRead 18 Oct 2026 | Nord Security SourceRead 26 Oct 2026 |
| Independent audits | 23 since 2019, 18 with a public report | 11 since 2018, 5 with a public report |
| Most recent audit | Apr 2026, Cure53: Apps and infrastructure SourceRead 26 Oct 2026 | 3 Feb 2026, Deloitte: No-logs SourceRead 26 Oct 2026 |
| RAM-only servers | ExpressVPN says its VPN servers run on RAM only and never write to hard drives. SourceRead 19 Oct 2026 | NordVPN says it chose diskless RAM servers instead of hard disk servers for its network. SourceRead 26 Oct 2026 |
| Open-source apps | ExpressVPN publishes the source of its Lightway protocol and its browser extension on GitHub, not the source of its desktop or mobile apps. SourceRead 26 Oct 2026 | The NordVPN Linux app is open source; the rest of the service is proprietary. SourceRead 19 Oct 2026 |
| Transparency report or canary | Government, law enforcement and civil requests; ExpressVPN says it had no logs to disclose. SourceRead 18 Oct 2026 | NordVPN publishes quarterly counts of government inquiries and DMCA requests: 79 government inquiries for July to September 2026. SourceRead 26 Oct 2026 |
| Incidents on record | 16 Sep 2021, Other: ExpressVPN's CIO was named in a US Department of Justice resolution over his earlier hacking work for a UAE company. SourceRead 19 Oct 2026 | Oct 2024, No-logs tested by police or court: NordVPN received a binding warrant from the Panamanian prosecutor's office in a criminal investigation. (2 on record, newest shown) SourceRead 26 Oct 2026 |
| Newest app versions | Windows 14.3.1 (22 Sep 2026) SourceRead 18 Oct 2026 macOS 14.3.1 (22 Sep 2026) SourceRead 18 Oct 2026 Linux 14.3.1 (22 Sep 2026) SourceRead 18 Oct 2026 Android 12.82.0 (9 Oct 2026) SourceRead 18 Oct 2026 iOS 12.76.0 (13 Oct 2026) SourceRead 18 Oct 2026 | Windows 8.14 (23 Oct 2026) SourceRead 26 Oct 2026 macOS 10.13 (16 Oct 2026) SourceRead 26 Oct 2026 Linux 5.4.1 (13 Oct 2026) SourceRead 18 Oct 2026 Android 9.15 (15 Oct 2026) SourceRead 26 Oct 2026 iOS 9.16 (19 Oct 2026) SourceRead 26 Oct 2026 |
Known VPN leak attacks
Each provider’s own statement for each app. “Not stated” means the provider published nothing on it.
| Attack | ExpressVPN | NordVPN |
|---|---|---|
| TunnelVisionA rogue DHCP server pushes routes (option 121) that pull traffic out of the tunnel while the VPN still shows connected. | Not affected Android SourceRead 18 Oct 2026 Mitigated Windows, macOS, Linux SourceRead 18 Oct 2026 Affected iOS SourceRead 18 Oct 2026 | Not affected Windows, Linux, Android SourceRead 18 Oct 2026 Mitigated macOS, iOS SourceRead 18 Oct 2026 |
| TunnelCrack LocalNetA rogue Wi-Fi network assigns itself public addresses the VPN treats as local, so traffic to them skips the tunnel. | Not affected Windows, macOS, Linux, Android SourceRead 18 Oct 2026 Mitigated iOS SourceRead 18 Oct 2026 | Not affected Windows, Linux, Android SourceRead 18 Oct 2026 Mitigated macOS, iOS SourceRead 18 Oct 2026 |
| TunnelCrack ServerIPA spoofed DNS answer for the VPN server makes the client route chosen traffic outside the tunnel. | Not stated All apps SourceRead 18 Oct 2026 | Not stated All apps SourceRead 18 Oct 2026 |
Audits on record
ExpressVPN
| Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|
| Apr 2026 | Cure53 | Apps and infrastructure | Pentest, code audit, design and crypto review of EventVPN, ExpressVPN's separate VPN product: architecture and software. | 1 critical, 2 high, 1 medium, 9 low | Report SourceRead 26 Oct 2026 |
| Jun 2025 | KPMG | Privacy policy | ISAE 3000 assurance on the privacy and no-logs commitments. | Not published | Report SourceRead 18 Oct 2026 |
| Nov 2024 | Cure53 | Apps | Aircove routers, second audit. | Not published | Report SourceRead 18 Oct 2026 |
| Oct 2024 | Cure53 | Protocol | Lightway after its rewrite in Rust, fourth audit. | Not published | Report SourceRead 18 Oct 2026 |
| Sep 2024 | Praetorian | Protocol | Lightway, third audit; the public report is the retest. | Not published | Report SourceRead 18 Oct 2026 |
| Jun 2024 | Cure53 | Browser extension | The VPN browser extension, second audit. | 1 medium | Report SourceRead 18 Oct 2026 |
| 16 Apr 2024 | Nettitude | Apps | Windows app, checking the fix for the split-tunnelling DNS leak. | 1 medium | Report SourceRead 18 Oct 2026 |
| Dec 2023 | KPMG | Privacy policy | Assessment of the privacy policy claims. | Not published | Report SourceRead 18 Oct 2026 |
| 13 Dec 2022 | Cure53 | Apps | White-box pentest and source code audit of the Android app. | Not published | Report SourceRead 26 Oct 2026 |
| Nov 2022 | Cure53 | Protocol | Lightway, second audit. | 5 low, 4 info | Report SourceRead 18 Oct 2026 |
| Oct 2022 | Cure53 | Browser extension | The VPN browser extension, first audit. | Not published | Report SourceRead 18 Oct 2026 |
| 28 Sep 2022 | Cure53 | Apps | Pentest and source code audit of the Aircove router UI, interfaces and firmware. | 4 medium, 2 low | Report SourceRead 26 Oct 2026 |
| Sep 2022 | KPMG | No-logs | ISAE 3000 Type 1 assurance on the no-logs policy. | Not published | SourceRead 18 Oct 2026Report not public |
| Sep 2022 | Cure53 | Apps | iOS app. | Not published | Report SourceRead 18 Oct 2026 |
| Aug 2022 | Cure53 | Apps | Linux app. | Not published | Report SourceRead 18 Oct 2026 |
| Jul 2022 | Cure53 | Apps | macOS app. | Not published | Report SourceRead 18 Oct 2026 |
| May 2022 | Cure53 | Servers and infrastructure | White-box review of TrustedServer, the in-house VPN server software. | None reported | Report SourceRead 18 Oct 2026 |
| Apr 2022 | F-Secure | Apps | Windows app version 12. | Not published | SourceRead 18 Oct 2026Report not public |
| Mar 2022 | F-Secure | Apps | Windows app version 10. | Not published | SourceRead 28 Oct 2026Report not public |
| Aug 2021 | Cure53 | Protocol | Lightway, first audit. | Not published | Report SourceRead 18 Oct 2026 |
| Jun 2020 | PwC | Backend and payments | PwC Switzerland on the build verification process. | Not published | SourceRead 18 Oct 2026Report not public |
| Jun 2019 | PwC | Privacy policy | PwC Switzerland on privacy policy compliance and TrustedServer. | Not published | SourceRead 18 Oct 2026Report not public |
| 28 Jan 2019 | Cure53 | Browser extension | Security review of the Chrome browser extension, October 2018; fixes verified in November 2018. | 3 medium, 2 low, 3 info | Report SourceRead 26 Oct 2026 |
NordVPN
| Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|
| 3 Feb 2026 | Deloitte | No-logs | Sixth no-logs assurance engagement, 10 November to 12 December 2025. | Not published | SourceRead 26 Oct 2026Report not public |
| 10 Dec 2025 | Cure53 | Apps | Pentest of all desktop and mobile apps, browser extensions, APIs and NordAccount login. | 3 high, 4 medium, 15 low, 8 info | SourceRead 26 Oct 2026 |
| 10 Dec 2025 | Cure53 | Servers and infrastructure | Pentest of VPN servers and supporting infrastructure, October 2025. | 2 high, 1 medium, 4 low, 2 info | SourceRead 26 Oct 2026 |
| 18 Feb 2025 | Deloitte | No-logs | Deloitte Audit Lithuania, fifth engagement, with access from 18 November to 20 December 2024. | Not published | SourceRead 18 Oct 2026Report not public |
| 9 Jan 2024 | Deloitte | No-logs | Fourth no-logs assurance engagement, 30 November to 7 December 2023: standard, Double VPN, obfuscated, Onion over VPN and P2P servers. | Not published | SourceRead 26 Oct 2026Report not public |
| 28 Feb 2023 | Cure53 | Apps | Pentest and source code audit of the Windows, Linux and macOS apps, browser add-ons and related backend services. | 1 critical, 2 high, 1 medium, 7 low, 11 info | Report SourceRead 26 Oct 2026 |
| 28 Feb 2023 | Cure53 | Servers and infrastructure | Pentest and source code audit of NordVPN servers and infrastructure. | 1 high, 2 medium, 1 low, 7 info | Report SourceRead 26 Oct 2026 |
| 10 Jan 2023 | Deloitte | No-logs | Reasonable assurance on IT system configuration against the no-logs claim, 21 November to 10 December 2022. | Not published | SourceRead 26 Oct 2026 |
| 1 Jul 2020 | PwC | No-logs | Second assurance engagement on the no-logs claim, 20 to 28 May 2020, adding obfuscated, Double VPN and P2P servers. | Not published | SourceRead 26 Oct 2026Report not public |
| 10 Oct 2019 | VerSprite | Apps | Penetration test of the NordVPN apps. | Not published | SourceRead 26 Oct 2026Report not public |
| Nov 2018 | PwC | No-logs | First assurance engagement on NordVPN's no-logs claim, ordered in late 2018. | Not published | SourceRead 26 Oct 2026Report not public |
Check it on your own connection
Records say what ExpressVPN and NordVPN state. A test shows what your own connection does today: run the ExpressVPN leak test with that app connected, or the NordVPN leak test with the other; each checks your IP, DNS, WebRTC and IPv6.
How this page is kept
- ExpressVPN’s column is read from expressvpn.com and github.com; NordVPN’s from nordvpn.com, support.nordvpn.com and sb.nordcdn.com. Auditors’ published reports count as well. Each cell links its source and the date it was read.
- “No statement on record” under ExpressVPN or NordVPN means our sources hold none for that provider. It is not a finding that ExpressVPN or NordVPN lacks the feature; check its own pages.
- This page does not rank ExpressVPN against NordVPN. Which row matters depends on what you need the VPN for.
- A script re-reads every ExpressVPN and NordVPN source weekly; when one changes, a person checks it before the ExpressVPN or NordVPN row changes. These records also feed every published VPN audit, who owns which VPN and leak issues by provider.
The data on this page as JSON: facts.json (CC BY 4.0) · All open data · Changes and Atom feed