Does ExpressVPN use quantum-resistant encryption, and why does it matter now?

Written byAlex Popa

Reviewed byAta Hakçıl

Edited byMagdalena Madej

November 12, 20266 min read

ExpressVPN uses quantum-resistant encryption in its proprietary Lightway protocol and WireGuard implementation. Both protocols use the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), a post-quantum algorithm standardized by the U.S. National Institute of Standards and Technology (NIST), to protect the connection between your device and ExpressVPN’s servers against future quantum attacks.

This matters now because encrypted traffic doesn’t have to be decrypted right away to be at risk. Someone could collect it today and decrypt it once sufficiently capable quantum computers exist, an approach known as a "harvest now, decrypt later" attack.

What is quantum-resistant encryption?

Quantum-resistant encryption refers to cryptographic methods designed to protect data from attacks by both today’s conventional computers and future quantum computers. It’s also known as post-quantum cryptography (PQC).

Quantum computers of the future pose a threat primarily to public-key (asymmetric) encryption, which devices use to verify each other’s identities and agree on the connection encryption keys. Widely used methods, such as Rivest–Shamir–Adleman (RSA) and elliptic-curve cryptography (ECC), rely on mathematical problems that conventional computers can’t solve in any practical amount of time.

Think of these methods as complex puzzles. A sufficiently capable quantum computer could solve the puzzle and break the encryption. Post-quantum algorithms avoid this by relying on different mathematical problems that researchers believe will stay hard to solve for both conventional and quantum computers.

Symmetric encryption, such as the Advanced Encryption Standard (AES), uses a single shared key to encrypt and decrypt data. It’s significantly less vulnerable to known quantum attacks than public-key cryptography.

ExpressVPN uses both types. Lightway encrypts your traffic with symmetric encryption: mainly AES-256, which most devices can speed up in hardware, or ChaCha20, an alternative symmetric cipher. The key for that encryption is agreed upon using elliptic-curve Diffie–Hellman (ECDH), a public-key method that a sufficiently capable quantum computer could break. If someone recorded the connection and broke the key exchange later, they could recover the key and decrypt the traffic. That’s the part of the connection we have upgraded with PQC.

How does ExpressVPN implement quantum-resistant encryption?

ExpressVPN uses hybrid post-quantum key exchange in Lightway and WireGuard. Hybrid means each connection combines a conventional key-exchange method with a post-quantum one, so the encryption key stays secure as long as at least one of the two methods holds.

Post-quantum key exchange in Lightway

Lightway is ExpressVPN’s own VPN protocol, which determines how your device establishes and maintains a connection to our VPN servers. It combines conventional cryptography with ML-KEM to agree on encryption keys.

Lightway includes post-quantum protection by default in both its User Datagram Protocol (UDP) and Transmission Control Protocol (TCP) modes, so there’s no separate setting to turn on.

It’s available in the ExpressVPN apps for Windows, macOS, Linux, Android, iOS, and routers.

Post-quantum WireGuard

WireGuard is a lightweight VPN protocol known for its speed and efficiency. Standard WireGuard doesn’t include post-quantum key exchange, so ExpressVPN built its own implementation that starts every session with a hybrid ML-KEM handshake.

Each session also gets a new encryption key and internal IP address, which makes it harder to link separate sessions to the same user. Post-quantum WireGuard is available in the ExpressVPN apps for Windows, macOS, Linux, Android, iOS, and Apple TV.

How to make sure your VPN connection uses post-quantum protection

To use ExpressVPN's post-quantum protection, install the latest ExpressVPN app for your device and connect using Lightway or WireGuard.

The app’s default protocol setting, Automatic, picks the protocol best suited to your network. In most cases, that’s Lightway, but Automatic can choose a different one depending on network conditions. To make sure every connection uses post-quantum key exchange, select Lightway or WireGuard directly.

1. Open the ExpressVPN app and go to the Profile tab. Click VPN Protocol.
   
2. Select Lightway – UDP, Lightway – TCP, or WireGuard.
   
3. Connect to a VPN server location. The app uses the protocol you selected.

Note: UDP usually gives the best speeds, while TCP can connect more reliably on networks that restrict UDP traffic. On Apple TV, you can select WireGuard in the protocol settings.

What ExpressVPN's post-quantum protection doesn't cover

ExpressVPN’s post-quantum protection secures the key exchange for the VPN tunnel between your device and an ExpressVPN server, but it doesn’t cover everything:

• Other VPN protocols: ExpressVPN doesn't currently provide post-quantum key exchange for its OpenVPN connections.
• Website connections: The connection between the VPN server and a website relies on that website’s own encryption, such as HTTPS.
• Compromised devices or credentials: Post-quantum key exchange can't stop someone from accessing your data through malware, stolen credentials, or other unrelated security breaches.
• Authentication: Quantum-resistant key exchange doesn't mean that every authentication method or digital signature in a connection also uses PQC.