NordVPN vs ExpressVPN

The short answer

NordVPN and ExpressVPN are two of the most checked VPNs on the market, and on technical evidence there isn't much between them. Both have had their no-logs claims reviewed by Big Four accounting firms, both have had security firms test their software, and both have post-quantum protocols. The differences sit in three places: who owns them, what has happened to each in the real world, and how clearly each states its torrenting rules.

ExpressVPN's best evidence is a 2017 case in which Turkish investigators seized one of its servers and reportedly found nothing useful. NordVPN's weak spot is a 2018 breach of a rented server, disclosed late. ExpressVPN's own controversies are about ownership and staff rather than data.

Tunnelcheck hasn't tested either service. The fact table above comes from our provider files, and this page interprets it. Sources are at the bottom; our method is on how we review.

Ownership and jurisdiction

NordVPN belongs to Nord Security, which also owns Surfshark since a 2022 merger. Its App Store seller is Nordvpn S.A. in Panama.

ExpressVPN is run by Express Technologies Ltd. under British Virgin Islands law, according to its terms. In 2021 Kape Technologies agreed to buy it for a reported $936 million. Kape also owns CyberGhost and Private Internet Access. Kape started as Crossrider, whose browser-extension platform was widely misused by adware makers before it changed course in 2016 and took the Kape name in 2018. In 2023 Unikmind, a company controlled by majority shareholder Teddy Sagi, took Kape private. Kape also bought Webselenese, publisher of the VPN review sites vpnMentor and Wizcase, in 2021.

So the choice is partly a choice between two groups, each with several VPN brands. If Kape's history matters to you, that's a reason to lean toward NordVPN. If you'd rather avoid a group that also owns Surfshark, that doesn't change much: you'd still be choosing one large group. See who owns your VPN.

Logging and audits

Both say they keep no activity logs. The audit table above lists each check; here is what the pattern tells you.

• NordVPN has a yearly no-logs series: PwC Switzerland in 2018 and 2020, then Deloitte Lithuania every year from 2022 to 2025 under ISAE 3000, the standard for assurance on non-financial claims. The 2025 round was a reasonable assurance engagement. It also had an app assessment by VerSprite (2021) and a Cure53 server penetration test (2022). Full reports are for logged-in customers.
• ExpressVPN had KPMG check its TrustedServer system and privacy policy under ISAE (UK) 3000 Type 1, as of February 28, 2025. A Type 1 engagement looks at how controls are designed at one point in time, not whether they kept working over months. ExpressVPN also names PwC Switzerland among its auditors, had its Lightway protocol reviewed by Cure53 and Praetorian, and said in May 2026 that it had completed 27 independent audits. Reports sit on its Trust Center behind a terms-of-use screen.

Read together: NordVPN's strength is repetition of the same kind of check. ExpressVPN's is breadth, with many separate audits of different parts. Neither is proof for all time. Our VPN audits page explains the difference between assurance engagements, penetration tests and code audits.

Track record

ExpressVPN. After the December 2016 assassination of Russian ambassador Andrei Karlov, Turkish investigators seized an ExpressVPN server. TorrentFreak reported that it yielded no useful logs. That is one of the few public cases where a no-logs claim met a real investigation, though the account comes mostly from the company and Turkish media. In 2021 Reuters reported that senior executive Daniel Gericke had entered a deferred prosecution agreement with the US Justice Department over hacking work for the UAE; ExpressVPN said it hadn't known and kept him on. In 2024 BleepingComputer reported a Windows app bug that, from May 2022 to February 2024, sent some DNS requests outside the tunnel when split tunneling was on. ExpressVPN put it at about 1% of Windows users, fixed it, and says an independent audit verified the fix.

NordVPN. In March 2018 an attacker accessed one server NordVPN rented in Finland through a remote-management tool the host had installed. An expired internal key was exposed. NordVPN said there were no activity logs on it and disclosed the breach in October 2019, which drew criticism for the delay.

Neither record shows user activity data reaching a third party. ExpressVPN has the stronger real-world test. NordVPN's breach and ExpressVPN's DNS bug are both reminders to run a leak test yourself.

Features and protocols

• NordVPN: NordLynx (WireGuard-based, post-quantum in all apps since May 2025), NordWhisper for restrictive networks, and OpenVPN. Specialty servers include Double VPN and Onion Over VPN. Ten devices at once.
• ExpressVPN: Lightway, its own protocol, open source and rewritten in Rust in 2025, with post-quantum protection by default; its own WireGuard build with post-quantum key exchange; OpenVPN; and IKEv2 on iOS only. Its kill switch is called Network Lock. Plans cover 10, 12 or 14 devices depending on tier.

ExpressVPN's open-source Lightway gives outsiders something to inspect, on top of the audits. NordLynx builds on WireGuard, which is itself open, but NordVPN's additions are its own. For background see WireGuard vs OpenVPN and VPN protocols. NordVPN's own feature pages refused our reader, so we haven't confirmed its kill switch details from the source.

Streaming and torrenting policies

Torrenting. This is the clearest practical difference. NordVPN's iOS release notes (version 9.6.0) say all regular servers support P2P, and its audits covered P2P servers. We found no ExpressVPN page that sets out which servers allow P2P. Its terms forbid downloading or distributing copyrighted content without permission. A VPN hides your downloads from your internet provider; it doesn't make copyright infringement legal. See is torrenting illegal.

Streaming. Neither NordVPN nor ExpressVPN controls whether a streaming service lets you in. Watching another country's catalog usually breaks the streaming service's terms of use, and services block IP addresses they link to VPNs, so what works one week can fail the next. We don't promise that either one gets anything unblocked. Our explainer on why streaming services block VPNs covers how the blocking works, and streaming while traveling covers the legal options when you're abroad.

Price

We couldn't record a price for either on 2026-11-13. NordVPN's pricing page refused our reader. ExpressVPN's order page showed prices only in Israeli shekels, set by the reader's location, and confirmed that plans auto-renew at a stated renewal price. See each official pricing page. ExpressVPN's terms give new direct subscribers a 30-day money-back guarantee. Our checked VPN prices page lists the providers we could verify.

Which should you pick?

• Pick ExpressVPN if you want an open-source protocol you can inspect, the widest spread of separate audits, or more than ten devices on one plan (up to 14 on its top tier).
• Pick NordVPN if you torrent and want a written P2P policy, prefer a yearly series of no-logs checks, or want to avoid Kape-owned brands.
• Look elsewhere if both groups' histories bother you. Proton VPN and Mullvad have different ownership models; compare them on Proton VPN vs NordVPN.