ExpressVPN brings passkeys and secure sharing to ExpressKeys, as new audit clears the app

The standalone password manager also adds direct credential imports, card scanning, and recovery tools. A new Cure53 assessment takes ExpressVPN’s published independent security audit total to 28, more than any other VPN provider.

British Virgin Islands, 2nd July 2026 — ExpressVPN today announced a major update for ExpressKeys, its standalone password manager, introducing full passkey support, secure item sharing, direct credential imports, and new tools for managing sensitive information across devices.

Alongside the product update, ExpressVPN has published a new independent security assessment of ExpressKeys by Cure53. The report found no High or Critical severity issues and brings ExpressVPN’s total number of published independent third-party security audits to 28, more than any other VPN provider.

The update reflects ExpressVPN's broader move to expand beyond VPNs to offer a comprehensive suite of cybersecurity and privacy products. Over the past two years, ExpressVPN has developed solutions spanning password management with ExpressKeys, email privacy with ExpressMailGuard, identity protection with Identity Defender in the U.S., and private-by-design AI with ExpressAI.

“ExpressKeys is becoming a much more complete security tool for everyday life,” said Bruno Magalhaes, Product Engineering Manager, at ExpressVPN. “This update gives people easier ways to move beyond traditional passwords, transfer their credentials, and share sensitive information with greater control. The Cure53 assessment also gives users an independent view of how the app has been built and secured.”

Full passkey support

ExpressKeys now lets users generate, store, and manage passkeys directly in the app.

Passkeys replace traditional text passwords with cryptographic credentials, reducing the risk posed by passwords that can be guessed, phished, or reused. Users can sign in to supported accounts using built-in authentication methods such as Face ID or fingerprint verification without having to create or remember another password.

Secure sharing for individual vault items

ExpressKeys users can now share individual vault items, including logins, payment cards, and secure notes, through a controlled link.

As an official supporter of the FIFA World Cup 2026™, ExpressVPN surveyed football fans across six countries about their password habits. Password sharing for sports content appeared across several markets: 23.7% of fans in Spain said they had shared a password so someone else could watch a match or other sports content, compared with 21.3% in the UK, 18.6% in the U.S., and nearly 17% in Australia.

The risk becomes more serious when the shared password is also used elsewhere. Among fans who had shared a password, 65% in the U.S. said it was the same password they used for another account, such as email, shopping, or banking. The figure was 47.4% in France, 43.7% in the UK, 38% in Germany, 36.9% in Australia, and 34.8% in Spain.

ExpressKeys provides a more controlled alternative to sending sensitive information through an ordinary text message or email, where it may remain in a conversation history or inbox long after it is needed.

Senders can choose how long the link remains active, with expiry options ranging from one hour to 30 days. They can also require the recipient to verify their email address or set the link to expire after it has been viewed once.

Users can review and disable a shared link from within ExpressKeys. Providing access to phone contacts is optional, and contact information remains on the user’s device.

“Most people share passwords by texting them, which can leave a permanent copy in chat histories or cloud backups,” said Magalhaes. “Item sharing gives users more control over who can view a credential, how long the link remains available, and whether it can be opened more than once.”

Direct imports through the Credential Exchange standard

ExpressKeys is among the first password managers to support the FIDO Alliance's Credential Exchange standard. The standard matters because switching password managers has long been one of the weakest moments in a user’s security: most services require exporting your entire vault into a plain-text file, which sits unencrypted on your device during the move and is a common reason people avoid switching to a better tool at all. Credential Exchange replaces that file-based step with a direct, encrypted transfer between supported providers.

ExpressKeys users can import credentials from Apple Passwords, Google Chrome, and other major password managers without ever creating an unencrypted export.

Card scanning and deleted-item recovery

The update also introduces several new features designed to simplify credential management.

On iOS, ExpressKeys users can now scan physical credit and debit cards using their phone camera and save the information directly to their vault. Android support is currently in development.

A new Recently Deleted folder holds removed items for 30 days before permanent deletion. This gives users time to recover a login, secure note, or other vault item that was deleted accidentally.

The update also includes:

• Encrypted vault backups
• Color-coded passwords for easier reading
• Expanded localization
• A dedicated screen for two-factor authentication codes
• Swipe gestures for faster vault management

Cure53 assessment takes ExpressVPN’s published audit total to 28

The new ExpressKeys assessment was conducted by Cure53, a Berlin-based cybersecurity firm. Five senior testers spent 16 days carrying out a white-box review of the ExpressKeys iOS and Android apps and their underlying architecture. The testers had full access to the source code and examined how sensitive user information is encrypted, stored, and handled.

Cure53 identified no High or Critical severity issues and said the tested scope presented “a solid overall impression in terms of its security.”

ExpressKeys addressed the findings raised during the assessment. Cure53 then retested the changes and verified that the fixes had been implemented.

The report is ExpressVPN’s 28th published independent third-party security audit. Its previous assessments have covered technologies and commitments, including the Lightway protocol, TrustedServer, its no-logs policy, and products across the wider ExpressVPN portfolio.

The complete Cure53 report is available on Cure53’s website.

Availability

ExpressKeys is available on iOS, Android, and as a browser extension for eligible ExpressVPN subscribers. Users can download the app and access the new features today.

Survey methodology

The research was commissioned by ExpressVPN in May 2026 and conducted through online market research provider Pollfish. It surveyed 1,000 football fans in each of six markets: the United States, United Kingdom, France, Germany, Spain, and Australia.

- ENDS -

About ExpressVPN

Founded in 2009, ExpressVPN helps millions of people worldwide take control of their digital privacy and security. Best known for its award-winning consumer VPN, ExpressVPN has evolved into a broader privacy and security company designed to protect users across every aspect of their online lives.

The company’s expanding portfolio includes the ExpressVPN app powered by its open-source Lightway protocol; ExpressKeys, a zero-knowledge password manager; Identity Defender, a dedicated identity protection app (U.S.); ExpressMailGuard for inbox privacy, and ExpressAI, a private-by-design AI platform built on confidential computing. The umbrella also extends to business and lifestyle solutions, including ExpressVPN for Teams for growing organizations and the holiday.com eSIM service.

ExpressVPN’s technology and privacy safeguards have been independently audited and verified by leading third-party experts, including PwC, Cure53, and KPMG.

Registered in the British Virgin Islands, ExpressVPN has been part of Kape Technologies since 2021. For more information, visit www.expressvpn.com.

Press Contact:
ExpressVPN Press Team
press@expressvpn.com