ExpressVPN's password manager just got a big upgrade with secure sharing, passkey support, and more

ExpressVPN upgraded its standalone password manager ExpressKeys with passkey support, encrypted secure sharing links, and cross-device credential management, including FIDO Credential Exchange support to reduce migration risk. The update adds features such as auto-destruct for shared links and a 30-day “Recently Deleted” vault, while a new Cure53 audit found no high- or critical-severity vulnerabilities (total audits: 28). Overall, the news is a positive product/security enhancement but is unlikely to materially move markets beyond the firm’s niche user base.

Analysis

This is more ecosystem validation than standalone monetization. The incremental value sits with the default identity rails — Chrome, Android, and Google Password Manager — because every credible move toward passkeys and secure credential exchange increases the odds that consumers and enterprises standardize on the platform already embedded in the OS/browser layer. That is a slow-burn share-gain story over 6-18 months, not a near-term earnings catalyst; the immediate effect on public markets is likely negligible.

The second-order loser is the long tail of standalone password managers and VPN add-ons that compete on trust and convenience but lack a native distribution advantage. As secure sharing and account transfer become table-stakes, differentiation compresses toward bundled ecosystems and away from point solutions, which can pressure pricing power and retention for smaller vendors. For security software more broadly, the feature set is bullish for adoption of passwordless auth, but that also means fewer legacy password-reset and vault-recovery workflows — a modest headwind to adjacent identity support revenue.

Contrarian take: the market may overread passkey headlines as an immediate security upsell when the real effect is product hygiene and reduced friction. If adoption remains consumer-led, conversion to paid enterprise features could lag, and the monetization accrues mostly to platform owners rather than the app vendors touting the functionality. The key watch item is actual passkey utilization and default-store migration over the next 1-3 quarters; if usage metrics stay low, this is noise rather than a durable thesis.

Key Decisions for Investors

• No direct trade in ARVY: treat this as a non-investable product PR with limited fundamental read-through unless we see measurable user adoption or pricing power in disclosures.
• Modest long GOOGL vs QQQ over 3-6 months: passkey standardization and credential portability reinforce Google’s browser/Android identity layer; risk/reward is favorable only if adoption metrics rise, so keep sizing small.
• Watch for a short opportunity in standalone password-manager vendors if any become public comps or IPO candidates: the competitive moat narrows as native OS/browser distribution becomes the default, but do not preemptively short without retention data.
• Set an alert on Google/Chrome security-product usage metrics and Android default wallet/password-manager engagement over the next 1-2 quarters; if adoption is flat, exit the thesis and treat this as feature parity, not share gain.