ExpressVPN has released an update to its ExpressKeys password manager that adds passkeys, controlled item sharing and direct credential imports. The 2 July announcement also introduces a Recently Deleted folder, giving users 30 days to recover removed vault items before permanent deletion.
The changes cover several different problems: signing in, sharing a credential with someone else, moving between password managers and recovering from an accidental deletion. They should be assessed separately when deciding whether to switch services.
Passkeys and sharing serve different purposes
ExpressKeys can now create, store and manage passkeys for supported accounts. Passkeys use cryptographic credentials and can be unlocked through methods such as Face ID or fingerprint verification. A website still needs to support the relevant sign-in method, so adding passkeys to a manager does not convert every existing account automatically.
For sharing, users can send an individual vault item through a controlled link. ExpressVPN lists expiry choices from one hour to 30 days, optional email verification and an option to expire the link after one view. The sender can review and disable shared links inside ExpressKeys.
An expiring link limits future access through that link. It cannot make a recipient forget information they have already read or copied. For an account that should no longer be shared, changing its credentials and reviewing active sessions may still be necessary.
Moving a vault needs its own checks
ExpressVPN says the update supports the FIDO Alliance’s Credential Exchange standard for direct encrypted transfers between supported providers. It lists imports from Apple Passwords, Google Chrome and other compatible managers, avoiding an intermediate unencrypted export file where the supported route is available.
Before removing an old vault, check the imported records and try several important logins. Recovery information, additional fields and shared items deserve attention alongside the ordinary username and password. Keep access to the original service until the migration has been verified.
The update also adds card scanning on iOS, with Android support described as in development, and includes encrypted vault backups and a dedicated screen for two-factor authentication codes. That platform distinction is relevant if a household uses both Android and iPhone.
ExpressVPN also announced a Cure53 assessment and says it found no High or Critical severity issues in the tested scope. An audit covers a particular product state and scope; it is not a guarantee that a service cannot have future security problems.
The features are available to eligible ExpressVPN subscribers through the ExpressKeys apps and browser extension. Check eligibility for the account you have before treating the announcement as a free upgrade for every user.
More coverage is in Password Managers.
Source: ExpressVPN, “ExpressVPN brings passkeys and secure sharing to ExpressKeys, as new audit clears the app”, 2 July 2026. Product image: ExpressVPN.
