Security and privacy decision
ExpressVPN
A competent engineer can build a useful single-server VPN for personal use over a weekend, but they cannot realistically reproduce ExpressVPN's global server network, proprietary protocol, audited TrustedServer infrastructure, cross-platform polished apps, or bundled services.
Visit website↗$2.99/mo
$36/yr
Read off the official pricing page.
$20one-off12 h to build
$0/mo2 h/mo upkeep
On cash alone, building overtakes the subscription at 1 seat.
Open-source builds that already do this
Every project below is open source and already does this job today. Fork one, self-host it, or take the parts you need - the build prompt further down assumes an empty file, and this is the shortcut past that. Licences differ; check the one on each card before you ship. All ExpressVPN alternatives, with the arithmetic →
What a replacement has to do
- Provide a secure VPN tunnel from a client device to a server so the client’s traffic is encrypted and proxied through the server.
What it still won’t have
- Global fleet of 113+ managed servers and many geographic exit locations
- Proprietary Lightway protocol and ExpressVPN client implementations
- TrustedServer RAM-only infrastructure and related audited no-logs guarantees
- Cross-platform polished apps, 24/7 live chat support, and bundled services (ExpressKeys, ExpressMailGuard, Identity Defender)
- Dedicated IP, split-tunneling integration across platforms, and built-in ad/tracker blocking
What remains hard
- Infrastructure at scale
Servers in 113 Countries
- Execution quality
Lightway protocol supports secure, high-speed connections
- Execution quality
TrustedServer technology with RAM-only servers
First-year cost
Keep paying
Paying is—cheaper in year one.
On cash alone, building overtakes the subscription at 1 seat.
Money you would actually spend
Time you would spend
—
What you would spend
What we assumed
The verdict above measures whether you could build it. This one is only about money.
Runnable build prompt
Build a single-user VPN replacement using DigitalOcean/Hetzner VPS and WireGuard: deploy a Docker-based WireGuard server, run an internal DNS resolver (Unbound) configured to prevent leaks, implement scripts to generate per-device configs and QR codes, provide a minimal web UI (React + Node/Express) to list/download configs and rotate keys, and add health checks and systemd unit for auto-restart. Out of scope: multi-region server fleet, proprietary Lightway protocol, mobile/desktop native apps, commercial identity-protection or password-manager features. Include error handling, logging, automated backup of server configs, and unit/integration tests for config generation and service start/stop.
How we checked
How the score was reached
- Partly verdict base52
- An open-source build was found+5
- 4 cited sources+3
- Price verified on pricing page+3
- Hard moats found in the evidence-3
- Evidence score60
The base comes from the verdict. Everything under it is a check that either happened or did not, and each one is a fact frozen in this record rather than a judgement made at render time - so the same evidence always produces the same number.
How scoring works →Cited sources · 4
Every page the run actually retrieved.
- official productExpressVPN (product)
- official pricingExpressVPN pricing
- official docsExpressVPN features
- open sourcehwdsl2/setup-ipsec-vpn
Integrity checks
What held up, and what did not.
