ExpressVPN for Android Introduces Passkeys, Login Tokens, and Email Code Sign-Ins

ExpressVPN has released an update for its Android application, adding three alternative authentication methods designed to reduce reliance on traditional passwords and activation codes.

According to reported details, the update introduces email verification codes, expiring login tokens, and passkey support. These options are currently rolling out gradually, with the company reporting an expectation that all Android users will have access to the features by the end of the year. Traditional email and password sign-ins remain available under legacy options on the app's welcome screen.

New Sign-In Methods Overview

• Email Verification Codes: Users enter their account's linked email address to receive a one-time code directly to their inbox.
• Login Tokens: Generated from the ExpressVPN+ web portal, these time-limited tokens can be pasted into the application or scanned as a QR code. They replace the older activation codes that remained static and never expired.
• Passkeys: Utilizing the FIDO2/WebAuthn standard, users can authenticate using passkeys stored via passkey managers, hardware security keys, or ExpressVPN's own ExpressKeys password manager.

Security and Practical Implications

Passkeys offer improved security and ease of use compared to traditional passwords, while time-limited login tokens mitigate the risk associated with static activation codes that could potentially be exposed. ExpressVPN advises users to treat login tokens with the same caution as passwords, avoiding sharing or posting screenshots of them.

To verify the availability of these new login methods, Android users can check for official application updates through the Google Play Store or review account settings directly within the updated ExpressVPN application.