ExpressKeys Update: Passkeys, Secure Sharing, and a New Cure53 Audit

ExpressVPN's password manager, ExpressKeys, just got one of its biggest updates yet — and a fresh independent security audit to go with it. The standalone manager, included free with eligible ExpressVPN subscriptions, adds passkeys, controlled secure sharing, painless imports, iOS card scanning, and a 30-day recovery bin. Alongside the features, a new Cure53 assessment reports no High or Critical severity issues. Here's what changed and how to read it.

What's new in ExpressKeys

All of the following are live now on iOS, Android, and the browser extension for eligible ExpressVPN subscribers:

The headline additions are passkeys and the safer import flow. Passkeys are the passwordless standard the whole industry is moving to, and importing without a plain-text export closes a real weak point — a decrypted CSV of all your logins sitting in your Downloads folder is exactly what you don't want during a migration.

The new security audit

ExpressKeys also received a new independent audit from Cure53, a well-known security firm. The assessment reported no High or Critical severity issues. ExpressVPN says this brings its total published independent third-party audits to 28 — more than any other VPN provider, and the full report is public.

A word on what that means. A clean audit from a reputable firm is a genuinely good signal — it shows the vendor invited outside scrutiny and fixed what was found. It is not a guarantee that the software is flawless, and audit scope matters (this one covers ExpressKeys as integrated into the mobile apps and the browser extension). But "no high or critical findings, published in full" is about as strong a transparency posture as you'll see in this category, and the sheer number of audits is a meaningful track record.

Who it's for

ExpressKeys makes the most sense if you're already an ExpressVPN subscriber — it's bundled at no extra cost on Advanced, Pro, and legacy plans, so there's little reason not to use it instead of storing passwords in your browser. The zero-knowledge encryption, cross-device sync, 2FA code generation, biometric unlock, and breach monitoring were already there; this update mostly closes the gap with dedicated managers on convenience features like passkeys and safe imports.

VPN vs Antivirus vs Password Manager: Which Tool Do You Need?

The honest take

Two caveats. First, bundling your password manager with your VPN is convenient but creates vendor lock-in — if you ever leave ExpressVPN, you'll be migrating your vault out (the new import tooling cuts both ways, but plan for it). Second, if you don't use ExpressVPN, a dedicated cross-platform manager may still suit you better; ExpressKeys' pitch is strongest as part of the ExpressVPN bundle, not as a standalone purchase. That said, for existing subscribers this update genuinely narrows the reasons to keep a separate manager.

Bottom line

The ExpressKeys update is a solid, practical step: passkeys and no-plain-text imports are the features that actually matter day to day, and the new Cure53 audit with no high or critical issues backs it up. If you already pay for ExpressVPN, it's now a more complete password manager that's included in what you're already paying — refresh the app and turn on passkeys. If you don't, weigh it against a dedicated manager rather than subscribing for ExpressKeys alone.

Get ExpressVPN (includes ExpressKeys)

Sources and further reading