PrivacyPick

Enpass vs ExpressKeys Comparison

Feature
EnpassVisit →
ExpressKeysVisit →
Overview
Rating6.85.8
Pricing
  • $1.99/moPremium (individual, 1-year)
  • $3.99/moFamily (up to 6, 1-year)
Show billing details
  • Premium (individual, 1-year): $23.99 per year
  • Family (up to 6, 1-year): $47.99 per year
Not specified
Free tierLimited free tierPaid only
EstablishedNot specified2022
Platforms
WindowsmacOSLinuxAndroidiOSBrowser extension
AndroidiOSBrowser extension
Security
Independent security auditNone on recordCure53 2026
Show audit details

White-box design and cryptographic-trust-assumption review plus dynamic penetration testing and source-code audit of the ExpressKeys Android and iOS apps and their shared Rust core. Five senior testers, sixteen days. Backend components and third-party dependency analysis were out of scope.

Source codeClosed sourceClosed source
EncryptionAES-256, PBKDF2-HMAC-SHA512 320K
Show details

The vault is a SQLite database encrypted via SQLCipher (AES-256-CBC). The Vault Key is derived from the Master Password — and, optionally, a keyfile — using PBKDF2-HMAC-SHA512 at 320,000 iterations, with a unique random salt per database.

AES-256, PBKDF2-SHA512
Show details

The vault is protected by a symmetric document key, itself wrapped by a root key derived from your vault password via PBKDF2-HMAC-SHA512 at 210,000 iterations. Cure53's March 2026 audit flagged this as GPU-crackable and recommended a memory-hard function (Argon2id or scrypt) instead.

Vault 2FANoneNone
Second-secret modelNoNo
Past data breachNoNo
TelemetryOn unless you opt outOn unless you opt out
Features
HostingLocal, no cloudCloud
PasskeysStores for sitesStores + unlocks
Built-in email aliasesNoNo
Company
OwnerEnpass Technologies Inc.Kape Technologies
Show details

ExpressVPN (and ExpressKeys as one of its products) is registered in the British Virgin Islands and has been part of Kape Technologies plc (LSE-listed, ultimate beneficial owner Teddy Sagi) since September 2021.