ExpressVPN launches post-quantum WireGuard, and publishes blueprint for the VPN industry 

BRITISH VIRGIN ISLANDS; August 6th, 2025 — ExpressVPN, a leading consumer privacy and security company, has launched a post-quantum implementation of the WireGuard® VPN protocol, engineered to meet modern privacy expectations. Alongside it, the company is publishing a full technical whitepaper, giving other VPN providers a definitive instructional resource to get ahead of the Quantum Computing era with their own post-quantum protocol. 

ML-KEM has been the post-quantum standard for more than a year. But just a select few VPN providers have moved beyond blog posts and marketing claims. The release is a call to action for the rest of the industry: post-quantum protections are essential, and they’re possible to implement now. 

WireGuard is fast and minimal by design, but most implementations ship without any post-quantum security and few default privacy safeguards at the protocol level. ExpressVPN’s version closes those gaps with scalable architecture, post-quantum cryptography, and dynamic, ephemeral session handling. And now, it’s sharing the work publicly. 

“Post-quantum threats aren’t theoretical. They’re already here. Adversaries can harvest encrypted traffic today and decrypt it later,” said Pete Membrey, Chief Research Officer at ExpressVPN. “Everyone’s shipping WireGuard, but few are doing it with a proper appreciation for the post-quantum issues. We built a version that actually holds up, and we’ve published the instruction manual along with it.” 

Post-Quantum as the new industry default

The new WireGuard deployment is engineered for today’s real-world risks. Every session starts with a post-quantum handshake using hybrid ML-KEM, the algorithm selected by NIST for quantum-safe encryption. Each connection gets fresh ephemeral keys and internal IPs. Short-lived tokens replace persistent credentials. And it all runs on TrustedServer, ExpressVPN’s RAM-only server platform. 

As an additional benefit, this now means more choice for ExpressVPN users. WireGuard is now available as a parallel protocol option, joining Lightway as part of a growing privacy toolkit. 

The accompanying whitepaper offers detailed guidance for VPN engineers and infrastructure teams, showing how to implement quantum-safe key exchange, ephemeral peer handling, and token-based authentication without modifying WireGuard itself. ExpressVPN’s goal is to raise the baseline across the ecosystem and make post-quantum protections easier to adopt.  

Tools for tougher conditions 

The company is also adding a new support for manual HTTPS proxy connections over Lightway TCP mode. This feature gives advanced users a fallback when VPN protocols are blocked or degraded—especially useful in restrictive environments where connection stability is unpredictable.

Together, these releases expand the toolkit for privacy-conscious users and raise the baseline for what protocol-level protection should look like. 

Availability 

Post-quantum WireGuard is available today (August 6) on ExpressVPN’s iOS, Android, and Windows apps. macOS support will follow soon. Proxy support is also live for users who configure their own infrastructure. 

Notes to Editor

Contact the ExpressVPN press team for more details or any questions: press@expressvpn.com   

About ExpressVPN

Since 2009, ExpressVPN has empowered millions of users to take control of their internet experience. The company's award-winning consumer VPN service is backed by its open-source VPN protocol, Lightway, delivering user privacy in just a few clicks. ExpressVPN’s Keys password manager, Aircove router range, and Identity Defender tools make digital privacy and security easy and accessible for all. ExpressVPN's products have been extensively vetted by third-party experts, including PwC, Cure53, KPMG, and others.

Registered in the British Virgin Islands, ExpressVPN has been part of Kape Technologies since 2021. To learn more about ExpressVPN’s industry-leading privacy and security solutions, visit www.expressvpn.com.