Without any public announcement, ExpressVPN has altered the terms governing its Keys password manager - now rebranded as ExpressKeys - in a way that limits what users can do with the tool once their VPN subscription expires. Where previous documentation promised continued full access, updated language in the company's Terms of Service and Knowledge Hub now states that former subscribers will not be able to add new passwords or entries. For users who chose ExpressVPN partly on the strength of that original promise, the change represents a quiet but meaningful withdrawal of a benefit they believed they had secured.
What the Original Promise Said - and What Replaced It
When ExpressVPN launched Keys in 2022, it was explicit: users who had subscribed to an ExpressVPN plan could continue using the password manager indefinitely after their subscription ended, with no restrictions described. A Reddit post from ExpressVPN at launch confirmed this, stating that users simply needed to keep the app installed. The company's Terms of Service, as archived from September 2025, reinforced this position: "Your Account will remain active, and the information added to ExpressVPN Keys will remain accessible to you even though you have ended your subscription Services." The language was unambiguous and carried no caveat about functionality being curtailed.
The updated Terms of Service, last revised on April 28, 2026, reads differently: "If previously activated, you can continue to access existing ExpressKeys credentials even if you decide to stop using our ExpressVPN Service, but you may not be able to add new information." The Knowledge Hub, updated four days earlier, is more direct still, confirming users "won't be able to add any new logins or other entries" once their subscription lapses. The shift from full access to read-only access is the operative change, and it appears nowhere in any formal product announcement.
Why This Matters Beyond the Fine Print
A password manager that cannot accept new entries is not a functioning password manager. Security professionals have long emphasized that the value of such tools lies in their role as a living, maintained record - updated as users create new accounts, change credentials, or adopt new services. Locking that capability behind an active subscription turns a security tool into an archive. Former subscribers who had organized their digital credentials around ExpressKeys and expected to continue doing so are now left with an incomplete solution that may push them toward migrating to an entirely different platform.
The broader concern is not merely practical but relates to trust. The technology industry has seen repeated friction arise from companies altering service terms after users have made decisions - purchasing decisions, behavioral decisions, data-organization decisions - based on stated conditions. ExpressVPN's situation reflects a pattern in which software-as-a-service products evolve away from commitments made at launch, particularly as those products are developed into premium tiers. ExpressKeys is now bundled with ExpressVPN's Advanced and Pro plans, which suggests a commercial rationale for tightening the terms: what was once a loyalty benefit has become a subscription incentive.
The Transparency Problem
Had ExpressVPN communicated this change openly - through an email to affected users, a product update post, or even a prominently flagged revision note - the situation would carry a different weight. Companies regularly adjust product terms as offerings mature, and that process, handled honestly, is accepted as part of how digital services operate. What is harder to defend is the approach taken here: revisions embedded in legal documents and support articles, with no accompanying disclosure to the users most affected.
Users who subscribed to ExpressVPN when Keys was positioned as a lasting benefit had a reasonable expectation that the rules would not change against their interests without notice. The current FAQ on the ExpressKeys product page still states that users "will retain access to credentials stored with ExpressKeys even if your ExpressVPN subscription expires" - language that is technically accurate but omits the restriction on adding new entries, creating a gap between what a prospective or returning user would understand and what the Terms of Service now specifies.
ExpressVPN has been contacted for comment on when this limitation was introduced, whether it has always been the intended long-term model, and what the company plans to communicate to users who relied on its earlier commitments. A response may clarify whether this represents a policy shift or a belated formalization of terms that were always intended. Until then, the documentary evidence points in one direction.
