Overview
This is the conventional kind of tunnel: a client with a long list of countries, a large connect button, and the ability to make your traffic appear to originate somewhere other than where you are. People use it for three things, protecting traffic on networks they do not control, keeping their internet provider from logging which sites they visit, and reaching content that is restricted by region. All three are the same mechanism wearing different hats.
The client here has the subscription check handled locally so every server location in the list is selectable without an account. The transport protocols including the provider's own lightweight one are all present, along with the split tunnelling, the kill switch and the leak protection, which are the features that separate a serious client from a toy one.
Protocols and connection quality
Three transport options are available. The provider's own protocol is the default and is designed for fast connection establishment and quick recovery when a network changes, which is what makes it feel responsive on a phone or a laptop moving between networks. The modern open protocol is the fastest in raw throughput on most connections. The older established protocol is the slowest and the most compatible, and it is the one to fall back to on a restrictive network that blocks the others.
Server selection can be automatic, picking the lowest latency location, or manual by country and city. Latency is shown in the list so a sensible choice can be made rather than guessing. Connection establishment usually takes a couple of seconds and reconnection after a network change is automatic.
Kill switch, leak protection and split tunnelling
The kill switch blocks all traffic if the tunnel drops, which is the difference between a momentary disconnection being invisible and being the exact moment your real address is exposed. It operates at the network filter level rather than by closing applications, so nothing slips through in the gap. This should be left on permanently and there is no good argument otherwise.
Leak protection covers domain lookups and the address family fallback, both of which are classic ways traffic escapes a tunnel without the user noticing. Split tunnelling lets specific applications bypass the tunnel or, in the inverse mode, lets only specific applications use it, which is how a banking application that objects to a foreign address keeps working while everything else stays tunnelled.
Practical use and honest limits
Speed through a tunnel is always lower than without one, and the loss depends far more on the distance to the server than on the client. A server in a neighbouring country typically costs a small percentage. A server on the other side of the world costs a great deal, and no protocol choice fixes physics.
The honest limitation is the same one every tunnel has: you are moving trust from your network operator to the tunnel operator, who by construction can see where your traffic goes. That is often a worthwhile trade on a network you do not control, and it is not the same thing as anonymity. Anyone who tells you otherwise is selling something.
What you get
- Every server location selectable with no account required
- Three transport protocols including a fast proprietary one and a modern open one
- Automatic lowest latency server selection with latency shown per location
- Network filter level kill switch that blocks traffic if the tunnel drops
- Domain lookup and address family leak protection
- Split tunnelling in both include and exclude modes per application
- Automatic reconnection after a network change
- Connection diagnostics and throughput testing built into the client
- Optional automatic connection on untrusted networks
Inside the archive
- ExpressVPN client installer, offline
- Adapter drivers for all three transport protocols
- Configuration profile with the kill switch enabled by default
- Language files for the interface list shown above
- Notes covering split tunnelling configuration
System requirements
| Operating system | Windows 10 version 21H2 or Windows 11, 64-bit |
|---|---|
| Processor | Any dual core processor |
| Memory | 2 GB |
| Graphics | No dedicated graphics required |
| Storage | 300 MB |
| Network | Any internet connection |
Installing it
- Unpack the archive and run the installer as administrator, since it installs network adapters.
- Allow all adapter drivers when prompted, otherwise some protocols will be unavailable.
- Launch the client and confirm the location list is fully populated.
- Leave the kill switch enabled. Turning it off defeats most of the point.
- Configure split tunnelling for any application that must not go through the tunnel.
Mirrors
| Route | Region | Note | State |
|---|---|---|---|
| Direct, primary | Europe | No wait, resumable | Online |
| Direct, secondary | North America | No wait, resumable | Online |
| Torrent magnet | Global | Small file, direct is simpler | Online |
Release history
- Server list refreshed with additional locations
- Reconnection after network change made faster on the proprietary protocol
- Fixed the kill switch releasing briefly during a protocol switch
- Split tunnelling inverse mode added
- Adapter drivers signed for current Windows builds
- Client interface rebuilt with per location latency display
Questions about this release
Which protocol should I use?
Start with the default proprietary one. If throughput matters more than reconnection speed, switch to the modern open protocol. Fall back to the older one only on networks that block the others.
Why is my speed halved?
Distance to the chosen server, almost always. Pick a location nearer to you and the difference usually disappears.
Does the kill switch really matter?
Yes. Without it, a dropped tunnel means traffic continues over your normal connection and you will not notice. Leave it on.
Does this make me anonymous?
No. It moves visibility from your network operator to the tunnel operator. That is often worth doing and it is not anonymity.
Comments
Split tunnelling inverse mode is what I needed, only the browser goes through and everything else stays local.
Nearby server costs me almost nothing in speed. Far away is a different story, as expected.
Comments are read before they appear. If a build stops working, say so here and it gets rebuilt rather than quietly left up.
Full location list, connects in about two seconds. Kill switch tested by pulling the cable and traffic stopped dead.