Overview
This client wraps everything the machine sends in an encrypted tunnel and hands it to a server elsewhere, so the local network, the carrier and the destination all see something different from what they would otherwise. The connection is one button and the client picks a nearby server automatically, with a full list available if a specific region is needed.
The transport is the part worth knowing about. Alongside the established tunnel protocols the client carries its own, designed to reconnect quickly after a network change and to keep throughput high on long routes, which is what makes streaming and large downloads usable through a tunnel rather than merely possible. Protocol selection can be left automatic or pinned manually where a network blocks certain traffic.
The safety features are the ones that matter in practice. A kill switch blocks all traffic if the tunnel drops, so nothing leaks out during a reconnection. Split tunnelling excludes specific applications from the tunnel, which is how printers, local network shares and banking applications keep working normally. Name resolution runs through the tunnel to avoid leaking lookups, and the client can start with the system and connect before anything else reaches the network.
What it does well
System wide tunnel
Every application on the machine is covered, not just the browser, with one connection toggle.
Fast transport protocol
A purpose built protocol alongside the established ones, tuned for quick reconnection and high throughput on long routes.
Kill switch
All traffic is blocked if the tunnel drops, so nothing escapes during a reconnection.
Split tunnelling
Exclude chosen applications so local devices, network shares and banking software keep working normally.
Wide server list
Locations across many regions with automatic selection by latency or manual choice per session.
Changes in this build
- Reconnection after sleep or a network change is substantially faster.
- Protocol selection logic improved on networks that throttle common tunnel traffic.
- Split tunnel rules now match on process path as well as application name.
- Lower idle resource use while connected for long periods.
- Fixed a conflict with some third party firewall drivers that blocked the adapter.
What is in the package
- ExpressVPN client installer, 64-bit
- Tunnel adapter driver
- Protocol modules including the fast transport
- Default split tunnel and kill switch profiles
- Multilingual interface files, 17 languages
System requirements
| Processor | Any x64 processor |
| Memory | 2 GB minimum |
| Graphics | Not applicable |
| Storage | 300 MB free |
| Display | 1024 x 768 minimum |
| System | Windows 10 or Windows 11, 64-bit, administrator rights for the adapter |
Installation
- Close and uninstall any other tunnel client first.
- Extract the archive and run the installer with administrator rights.
- Allow the adapter driver to register, and reboot if prompted.
- Apply the included configuration step before connecting.
- Turn the kill switch on and add split tunnel exclusions for local devices.
Before you start
Two tunnel clients installed together will fight over routing, keep one.
Printers and network shares usually need a split tunnel exclusion.
A tunnel adds latency by definition, pick a nearby server for anything latency sensitive.
Questions about this title
Is it system wide?
Yes, all applications are covered rather than only browser traffic.
What does the kill switch do?
It blocks traffic entirely if the tunnel drops, preventing anything leaking during reconnection.
Can I exclude specific applications?
Yes, split tunnelling excludes them by application or process path.
Does it leak name lookups?
No, resolution is carried through the tunnel rather than sent to the local network resolver.
About this listing
This entry was checked on a clean install of Windows 10 / 11 (64-bit) before it was published, and it is rechecked whenever the package is rebuilt. The figures on this page come from the site index rather than from the publisher, so the download count is what people here have actually pulled.
If a mirror stops answering, use the contact form and it gets replaced. Reports about a specific title are handled faster than general messages because they name the file, the mirror and the point at which the transfer stopped.
Requests for a different version, a different language build or an older release go on the requests page. Older versions of a title are usually still held even when only the current one is listed.