# URnetwork vs ExpressVPN ExpressVPN is the premium flagship of the mainstream VPNs; URnetwork splits the path so the exit never learns who you are and the operator cannot read the sealed session. **Choose ExpressVPN** if you value the industry's largest third-party testing program, a diskless datacenter fleet, and mature apps on everything from phones to its own router. **Choose URnetwork** if you want residential exits, city selection, and a split path. Both turn post-quantum encryption on by default. ExpressVPN is the more tested product. URnetwork splits visibility between its operator and a member-run provider. [ExpressVPN](https://www.expressvpn.com) is based in the British Virgin Islands and has been owned since 2021 by Kape Technologies, which also owns Private Internet Access and CyberGhost. It has often moved first on engineering: RAM-only servers in 2019, and post-quantum key exchange on by default on its open-sourced Lightway protocol from early 2025. As of mid-2026 it markets 214 locations in 113 countries. URnetwork uses member-run exits. The provider does not receive your source IP on the relayed path. Native apps seal traffic to the provider by default. [How URnetwork works](/docs/overview) explains the full design. The [threat model](/docs/threat-model) holds the complete record of what is stored and enforced. ## Six differences that affect the choice | | ExpressVPN | URnetwork | |---|---|---| | Trust model | One company; the server that terminates your tunnel sees your IP and your destinations together | Two relay parties; the exit never sees your IP, and the operator cannot read the sealed session | | Exit address | Datacenter ranges, publicly known, widely blocked by streaming and retail sites | Residential addresses; ordinary traffic to the sites you visit | | Coverage and targeting | 214 marketed locations in 113 countries; about half are virtual by its own support list | Member devices in 90+ countries; browse countries, search for a city | | External verification | About 28 listed engagements, 2018–2026, four of them privacy attestations; a 2017 server seizure reportedly found nothing usable | Open client and server code; no independent audit of the protocol or server code yet | | Fleet | TrustedServer: RAM-only, reinstalled from a signed image at each boot; predictable speed | Member uplinks; speed moves with the provider | | Apps and platforms | A decade of refined apps: desktop, mobile, TV, extensions, the Aircove router | Android, iOS, macOS, Windows, Linux, and a browser extension paired with its web app | Caveats below the table: - Post-quantum encryption is parity, on by default on both sides. ExpressVPN runs ML-KEM on Lightway, the protocol its apps pick by default; sessions over OpenVPN or IKEv2 carry no post-quantum protection. URnetwork's X25519MLKEM768 client-to-provider session is default in the native apps, skipping any provider it cannot seal to rather than downgrading. The browser extension has no sealed session; there, the operator's data path logs nothing, pinned by a test in the open code. - Both ship kill switches; ExpressVPN's is Network Lock, and URnetwork's is an explicit toggle on every platform, with the extension's on by default. - An ExpressVPN account requires an email address; bitcoin is accepted through a payment processor as of early 2026. URnetwork's Instant Account takes one tap and no email, and Pro can be paid in on-chain USDC. - ExpressVPN is one of the most expensive majors: long-term promotional rates roughly $3.50–7.50/month as of early 2026, typically higher at renewal, with no free tier and a 30-day money-back guarantee. URnetwork Pro is $5/month or $40/year, with a free daily allowance. Current numbers are at [ur.io/products](https://ur.io/products). ## The testing record, decomposed No rival's third-party program is larger or more continuous. ExpressVPN listed about 28 engagements from 2018 through mid-2026. Read the composition rather than the count. Four attest the privacy claims: PwC in June 2019, then KPMG in 2022, 2023, and February 2025, the last finding "no exceptions" expressly as of February 28, 2025. The rest are scoped penetration tests of single components: per-platform apps, browser extensions, the Lightway protocol, TrustedServer, the Aircove router, and lately non-VPN products such as a password manager. Each engagement is real. The aggregate number is the marketing. Two dated events sit beside the reports. In December 2017, Turkish authorities investigating the Karlov assassination seized an ExpressVPN server and reportedly found nothing usable. That is the one adversarial test of its no-logs stance, and stronger evidence than any commissioned audit. And from May 2022 to February 2024 the Windows app leaked DNS queries whenever split tunneling was on, exposing visited domains to outside DNS servers. A CNET reviewer surfaced it, not an audit, though roughly fifteen engagements ran in that window; split tunneling was disabled entirely while the feature was rebuilt. RAM-only servers say nothing about client-side bugs. ![How you verify a privacy claim — point-in-time audits vs court and raid evidence vs open continuous verification](/docs-assets/infographic-verification.svg) *ExpressVPN's attestations are the first kind of evidence, and the 2017 seizure is the rarer second kind. URnetwork's is the third: open code anyone can check on any day, with no independent examination of the protocol or the operator's server code yet.* ## TrustedServer and the location map TrustedServer is real engineering, and it shipped first. Every server runs RAM-only, with the whole software stack reinstalled from a signed image at each boot, so nothing persists across a restart; PwC reviewed the design in 2019 and Cure53 tested it in 2022. A running server still sees the sessions it terminates. What the design bounds is persistence, not visibility, and the 2022–2024 DNS leak was a client-side bug no server design could reach. The map is a different story, and ExpressVPN's own support pages tell most of it. They define a virtual location, where "the registered IP address matches the country you selected, while the physical server is located in another country," call the practice "a small number" of locations, and then list about a hundred: some 60 countries, China, India, Turkey and Vietnam among them, plus roughly 40 US cities that carry the all-50-states claim, served from hubs such as Singapore, Germany, the Netherlands, and larger US datacenters. That is nearly half the location list, disclosed more fully than most rivals manage. Outside measurement agrees: IPinfo's December 2025 study measured 57% of ExpressVPN's advertised locations virtual or unmeasurable. In 2022 it removed its India servers rather than comply with CERT-In's logging mandate, and has served India virtually since. ![Advertised locations vs measured reality — share of advertised locations measured virtual or unmeasurable per provider (IPinfo, December 2025)](/docs-assets/infographic-virtual-locations.svg) *ExpressVPN measured 57%. Mullvad, IVPN and Windscribe measured 0%. URnetwork appears as a mechanism rather than a percentage, because a provider is the presence.* URnetwork's counts are built differently. A location is listed only while a member's device is online in it, and the network geolocates the connection it observes rather than letting a provider declare a city. A provider egressing through its own VPN or a hosting range is detected and demoted, not excluded. Nobody has run IPinfo's study on URnetwork. Datacenter ranges are published, so many streaming and retail sites block them wholesale; URnetwork's exits are residential addresses, and their traffic is ordinary to the sites that receive it. Consistency runs ExpressVPN's way: its fleet returns a steady number every session, while URnetwork's speed moves with each member's uplink. URnetwork puts its average streaming speed at 40 Mbps+. ## Kape, the owner ExpressVPN's owner is part of its record. Kape Technologies, renamed from Crossrider in 2018 after its browser-extension platform became known for ad-injection abuse, bought ExpressVPN for $936M in 2021 and was taken private in 2023 under majority owner Teddy Sagi. It also owns Private Internet Access and CyberGhost. In March 2021 it paid about $149M for Webselenese, operator of the VPN review sites vpnMentor and WizCase; in mid-2026 vpnMentor scored ExpressVPN, CyberGhost, and PIA at 9.9, 9.7, and 9.5, above every non-Kape rival on its list. vpnMentor prints a disclosure naming Kape; sister site SafetyDetectives names only an unspecified parent company. Disclosed and legal; it also means several of the sites ranking ExpressVPN first share its owner. Two more ownership facts, dated and neutral. In September 2021, CIO Daniel Gericke was named in a US deferred prosecution agreement over hacking for the UAE's Project Raven, admitted conduct settled at $335,000; the company said it had "known the key facts relating to Daniel's employment history since before we hired him." And jurisdiction runs both ways: the BVI has no data-retention law and sits outside the 5/9/14-Eyes arrangements, which slows foreign legal process, but incorporation constrains process, not owners. ## Where ExpressVPN wins - Verification depth. About 28 third-party engagements, four privacy attestations among them, plus the 2017 seizure. URnetwork's two 2025 assessments cover its web app, API, and Android app, not the protocol or the server. - Consistency. TrustedServer hardware returns the same speed every session, where URnetwork's throughput moves with the providers in your window. - Reach of the apps. TV platforms, browser extensions, and the Aircove router, refined over a decade. - Operating history. A decade-plus of it, against a young network. ## Where URnetwork wins - The split. The exit never learns who you are, and the operator cannot read the sealed session. No single party holds identity and destinations together. - The exit address. Residential IPs work where ExpressVPN's known ranges are blocked outright. - Aim. Search a city by name wherever members are online; much of ExpressVPN's map is virtual by its own list. - One-tap anonymity. An Instant Account with no email, restored on a new device by its recovery phrase; ExpressVPN requires an email. - Price. $5/month or $40/year with a free daily allowance, against premium pricing with none. - Whole-stack source. Client and server code are public; ExpressVPN publishes Lightway and keeps its apps and servers closed. - Independence. A small operator with no conglomerate owner, sibling VPN brands, or review sites to reason about. - The supply side. Members can share their connection as participants in the [UR protocol](https://ur.xyz). ExpressVPN has no equivalent role. ## Limits and evidence URnetwork's main limits: - No independent audit covers the protocol, the connect engine, or the operator's server code. Two 2025 third-party assessments cover other surfaces: a penetration test of the web application and API (April–May 2025), and the Leviathan MASA AL2 assessment of the Android app, which passed. Leviathan writes that its assessment "should not be read as a holistic security evaluation or comprehensive penetration test." Neither examined logging, retention, or the data path. Against the deepest testing program in the industry, this is the widest gap in the comparison. - The split assumes the operator and the providers in your window are independent. Nothing in the system attests that independence, and no outside party has measured the fleet. See the [threat model](/docs/threat-model), §6.1. - The WireGuard-compatible fallback endpoint assigns one stable tunnel address, so several providers could recognize the same client across sessions. The native tunnel is the recommended path. - Coverage counts are self-published. IPinfo measured ExpressVPN from outside; nobody has run that study on URnetwork. ExpressVPN's limit is structural. Its server terminates your tunnel, so one position can see your real IP and your destinations together. Its own privacy policy lists what it keeps per account: apps and versions activated, the day but not the time of connection, the location chosen, your country and ISP, and total bytes transferred. That is leaner than most rivals keep, and it is still a per-user usage record. TrustedServer bounds how long anything persists, not what a running server can observe, and the promise is kept by a subsidiary whose owner also owns two competing VPNs and the review sites above. Trying URnetwork costs nothing: the Instant Account takes one tap and no email, so you can test it against your own sites before paying for either product. More questions are answered in the [FAQ](/docs/faq).