Have you ever waited longer than expected for a VPN to connect or experienced an interruption after switching from Wi-Fi to mobile data? Some older VPN protocols can take longer to reconnect when the underlying network changes, potentially causing noticeable disruptions during everyday use.
If you are wondering what ExpressVPN Lightway is, this review provides an objective look at its architecture, security, performance, and limitations. We examine the Rust-based implementation released in 2025, the newer capabilities available in 2026, the findings from independent security audits, and how Lightway compares with WireGuard in everyday use.
Key takeaways
- Lightway is ExpressVPN’s modern VPN protocol, rebuilt in Rust to reduce common memory-safety risks and support faster development.
- Independent audits identified several security findings, which ExpressVPN addressed before the fixes were independently reviewed.
- Automatic is the recommended setting for most users, while Lightway UDP is a strong manual choice for streaming, gaming, browsing, and video calls.
- Lightway remains closely tied to ExpressVPN, despite its open-source implementation.
- Lightway Turbo can increase throughput on Windows, but it currently has platform and feature compatibility limitations.
1. What is Lightway protocol?
Lightway is a VPN protocol developed by ExpressVPN to provide fast connection handling and smoother network transitions. It controls how the ExpressVPN app creates an encrypted tunnel, authenticates the connection, and transfers data to a VPN server. Unlike older protocols designed for a wider range of networking environments, Lightway focuses on the needs of modern consumer VPN apps. Its architecture emphasizes simplicity, faster reconnection, and easier maintenance.
1.1. Lightway explained in simple terms
Lightway uses a compact core implementation containing roughly 2,000 lines of code. Its smaller architecture reduces complexity and makes the protocol easier to review, maintain, and update.
OpenVPN has a larger and more mature codebase because it supports many configurations developed over several decades. Lightway follows a more focused design built around fast connection handling and modern VPN applications. A smaller codebase does not automatically guarantee higher speeds or longer battery life. Actual performance still depends on the device, operating system, VPN server, and network conditions.
1.2. Where is Lightway available?
Lightway is primarily available through ExpressVPN apps and router products. Although its Rust implementation is open-source, adoption outside the ExpressVPN ecosystem remains limited. Users can select Lightway on Windows, macOS, Linux, iOS, and Android. It is also supported on routers running ExpressVPN software and compatible Apple TV devices.
2. How does Lightway actually work?
Lightway uses a compact architecture designed for fast connection handling, efficient encryption, and smoother network transitions. It keeps track of the VPN session so the connection can recover more quickly after a temporary network interruption. The protocol works together with other ExpressVPN security features rather than replacing them. For example, Lightway manages the VPN tunnel while the kill switch helps protect traffic during connection loss.
2.1. Fast reconnection and session continuity
Lightway preserves the existing VPN session when the underlying network changes. This helps the ExpressVPN app reconnect more quickly after switching between Wi-Fi and mobile data. If internet access is temporarily unavailable, Lightway places the session in an idle state instead of immediately removing its connection information. Once the device reconnects, the protocol can resume the session with the same VPN server.
This design may reduce noticeable interruptions during streaming, browsing, or video calls. However, it does not prevent the underlying internet connection from dropping.
2.2. Lightweight architecture and device efficiency
Lightway was designed to operate efficiently across smartphones, laptops, and routers. Its focused architecture may reduce unnecessary processing overhead, although actual CPU usage and battery impact still depend on the device, operating system, selected cipher, and workload.
2.3. AES-256-GCM and ChaCha20-Poly1305
Lightway protects VPN traffic using AES-256-GCM or ChaCha20-Poly1305. Both options provide encryption and authentication, helping protect data and detect unauthorized changes.
AES-256-GCM can perform efficiently on processors with dedicated AES hardware acceleration. ChaCha20-Poly1305 may perform better when hardware support is unavailable or less effective. Neither cipher is always faster on every device. For most users, allowing the ExpressVPN app to select the cipher automatically is the simplest option.
3. What changed in Lightway from 2024 to 2026?
Lightway received three major upgrades between late 2024 and 2026: ML-KEM protection, a complete rewrite from C to Rust, and Lightway Turbo. These changes focused on memory safety, future cryptographic threats, and higher throughput. Each update improved a different part of the protocol. Rust changed the software architecture, ML-KEM strengthened key establishment, and Lightway Turbo added an optional performance feature.
3.1. The rewrite from C to Rust
ExpressVPN publicly released the Rust-based implementation of Lightway in February 2025, with deployment continuing across supported platforms afterward. The rewrite replaced the original C implementation after the updated code underwent independent security assessments.
Rust reduces many common memory-safety risks through compile-time checks. This can help prevent programming errors such as buffer overflows and invalid memory access. However, Rust does not make Lightway completely vulnerability-free. Logical errors, implementation flaws, external dependencies, and unsafe code can still create security risks.
The Rust rewrite should therefore be viewed as a meaningful risk reduction rather than a complete security guarantee. Independent audits and ongoing code review remain necessary.
3.2. ML-KEM post-quantum integration
Lightway uses ML-KEM alongside established cryptography to strengthen key establishment against possible future quantum attacks. The technology is designed to protect long-lived sensitive data from emerging cryptographic threats. ML-KEM helps the VPN endpoints establish a shared secret. It does not replace AES-256-GCM or ChaCha20-Poly1305, which continue to encrypt and authenticate VPN traffic.
This hybrid approach may reduce the risk of “harvest now, decrypt later” attacks. However, post-quantum protection does not make the entire VPN application immune to every security threat.
3.3. Lightway Turbo: Faster multi-lane tunneling with trade-offs
Lightway Turbo is a Windows feature designed to increase available bandwidth on supported connections. Its dual-tunnel mode sends data over two connection paths rather than relying on a single one. This approach may improve download speeds, upload speeds, or latency when a single connection path becomes a bottleneck. Actual results still depend on internet speed, routing quality, server load, and device performance.
Lightway Turbo currently cannot be used with split tunneling or Lightway TCP. Some websites, apps, or games may also experience compatibility problems when the feature is enabled. For most users, standard Lightway UDP remains the most compatible option. Lightway Turbo is better treated as an optional performance feature for supported Windows connections.
4. Is ExpressVPN Lightway safe to use?
Yes, Lightway is generally considered a secure VPN protocol based on its modern cryptography, open-source implementation, and independent security assessments. However, no protocol can be guaranteed to be completely free from vulnerabilities, so its audit findings and remediation process provide more useful evidence than marketing claims alone.
The Rust implementation underwent separate assessments by Cure53 and Praetorian before its public release. Both firms identified security findings, and ExpressVPN addressed the reported issues through remediation and independent review.
4.1. Open-source implementation
Lightway’s current Rust implementation is open-source and available for public inspection on GitHub. This allows security researchers and developers to examine the protocol architecture, review implementation decisions, and report potential weaknesses. Open-source code improves transparency but does not automatically guarantee security. Vulnerabilities can still exist in public code, external dependencies, application integrations, or future software updates.
4.2. What the independent audits actually found
The independent audits found real implementation issues rather than simply approving Lightway without criticism. Cure53 documented five findings, while Praetorian reported two low-risk issues related to file-permission validation and the handling of sensitive command-line data.
| Audit | Main findings | Remediation status |
|---|---|---|
| Cure53 (2024) | Five findings, including one High-severity server DoS vulnerability | The High-severity issue was fixed and independently verified |
| Praetorian (2024) | Two Low-risk configuration and validation issues | Both findings were fixed and confirmed during retesting |
Cure53 found that unauthenticated data fragments could potentially be used to consume excessive server memory and cause a denial-of-service condition. ExpressVPN implemented a fix, and Cure53 verified that the reported vulnerability no longer existed.
Praetorian also retested its two findings after ExpressVPN applied the recommended changes. The firm confirmed that both issues had been fixed and that corresponding safeguards had been implemented. These findings do not necessarily indicate that Lightway was broadly insecure. Instead, the disclosure, remediation, and retesting process provides evidence that the reviewed code received meaningful external scrutiny.
4.3. The limits of cryptographic library validation
Lightway uses wolfSSL for cryptographic functions, and ExpressVPN notes that the library has undergone extensive third-party evaluation, including assessment under FIPS standards. This provides supporting evidence for the underlying cryptographic components but should not be interpreted as certification of the entire VPN service.
FIPS validation applies to specific cryptographic modules, versions, configurations, and operating environments. Therefore, the use of a FIPS-validated wolfCrypt module does not automatically mean that the entire Lightway protocol or ExpressVPN application is itself FIPS-certified.
5. Lightway vs. WireGuard vs. OpenVPN
Lightway is not universally better than WireGuard or OpenVPN because each protocol has different design priorities. The most suitable option depends on network conditions, device support, application features, and whether the user prioritizes speed, compatibility, or manual configuration.
Lightway is optimized around the ExpressVPN ecosystem, while WireGuard is a widely adopted modern protocol used across many VPN services. OpenVPN has a longer track record and broader configuration flexibility, although its larger architecture may involve more overhead.
5.1. Protocol feature comparison
| Feature | Lightway | WireGuard | OpenVPN |
|---|---|---|---|
| Architecture | Compact ExpressVPN-developed protocol | Compact and widely adopted open-source protocol | Mature and highly configurable open-source protocol |
| Core code size | Approximately 2,000 lines | Approximately 4,000 lines | Significantly larger; estimates vary by version and scope |
| Encryption | AES-256-GCM or ChaCha20-Poly1305 | ChaCha20-Poly1305 | Configurable; commonly uses AES-GCM |
| Transport options | UDP and TCP | UDP | UDP and TCP |
| Network transitions | Designed to preserve session state | Roaming behavior depends on provider implementation | Reconnection depends on the app and configuration |
| ExpressVPN integration | Deep integration with Lightway-specific features | Custom ExpressVPN implementation with privacy and post-quantum enhancements | Primarily retained for compatibility and alternative connections |
| General use | Everyday ExpressVPN connections | Modern high-performance alternative | Compatibility and troubleshooting |
The codebase figures provide general architectural context but should not be treated as direct performance scores. A smaller codebase may be easier to audit and maintain, but it does not automatically guarantee faster speeds or stronger security.
Note: ExpressVPN adds ML-KEM protection to its own WireGuard implementation. Post-quantum key establishment is not a native feature of the standard WireGuard protocol.
These include its idle connection model and post-quantum protection enabled by default via machine learning key encapsulation.
5.2. Speed performance and network anomalies
First, let us look at the actual throughput performance. We ran sustained throughput tests across three server distances from Vietnam using our own test environment to establish a baseline.
| Protocol | Local (Vietnam) | Nearby (Hong Kong) | Long Distance (US) |
|---|---|---|---|
| Lightway UDP | 449.61 Mbps | 471.95 Mbps | 24.29 Mbps |
| WireGuard | 491.46 Mbps | 411.03 Mbps | 357.21 Mbps |
| OpenVPN UDP | 17.63 Mbps | 407.90 Mbps | 23.60 Mbps |
The data reveals a fascinating shift in performance dynamics. WireGuard delivered the fastest local speeds in Vietnam, reaching over 490 Mbps. However, Lightway took the lead on regional connections to Hong Kong, proving highly efficient for nearby streaming.
The most significant finding involves the long-distance connection to the United States. WireGuard maintained an impressive 357 Mbps while Lightway and OpenVPN suffered massive routing anomalies, dropping below 25 Mbps. This proves that extreme physical distance impacts certain protocols heavily.
OpenVPN showed highly inconsistent results throughout our testing process. It performed adequately on the Hong Kong server but completely collapsed on both the local and long-distance routes. This confirms that modern alternatives are far superior for maintaining high bandwidth connections.
ExpressVPN speed test on local server
ExpressVPN speed test on nearby server
ExpressVPN speed test on a long-distance server
5.3. Which protocol should you choose
To summarize the technical data, here is exactly when you should deploy each protocol for the best digital experience. You should always test multiple options if your initial connection feels sluggish.
- Use Lightway if: You use ExpressVPN and want the fastest possible speeds for 4K streaming or gaming. It is the absolute best choice for everyday performance and future-proof quantum protection.
- Use WireGuard if: You use other major privacy providers like NordVPN or Surfshark. It provides excellent speeds and low battery consumption for standard browsing and heavy media consumption.
- Use OpenVPN if: You are connected to a heavily restricted network such as a school or workplace. It excels at bypassing complex firewalls and strict internet censorship where newer protocols might fail.
6. How to set up and configure Lightway
Most users should leave the ExpressVPN protocol setting on Automatic. The app selects an available protocol based on the device and current network conditions, while manual selection is available for users who want greater control. Lightway also includes advanced options on supported mobile applications. These settings allow users to test different encryption ciphers, enable NAT heartbeats, or route Lightway traffic through an HTTPS proxy.
6.1. Automatic vs. manual protocol selection
Automatic is the simplest option because ExpressVPN manages protocol selection without requiring manual configuration. It does not guarantee that Lightway will be selected in every situation, as the chosen protocol may vary by device and network conditions.
To select Lightway manually:
- Step 1: Open the ExpressVPN app and select Profile.
- Step 2: Open the VPN protocol.
- Step 3: Select Lightway – UDP or Lightway – TCP.
- Step 4: Reconnect to apply the selected protocol.
Manual selection keeps the app on the selected protocol until the setting is changed again.
6.2. Lightway UDP vs. TCP: Which should you use?
Lightway UDP is generally the first manual option to try for browsing, streaming, gaming, and video calls. It prioritizes lower overhead and faster data transmission, making it suitable for most everyday connections.
Lightway TCP may be useful when UDP is blocked or repeatedly fails on a restrictive network. TCP adds additional delivery and congestion-control mechanisms, which may improve compatibility but can also increase overhead.
6.3. Selecting ciphers and enabling NAT heartbeats
Lightway supports AES-256 and ChaCha20, and ExpressVPN normally selects a cipher automatically. Supported iOS and Android apps also allow users to test the available options manually when troubleshooting performance.
The NAT heartbeat option sends small packets through the VPN tunnel every few seconds to keep the connection active. This may help reduce delayed email or messaging notifications when a mobile device has been inactive.
6.4. Using Lightway Proxy with an HTTPS proxy
Lightway Proxy routes VPN traffic through a user-specified HTTPS proxy before it reaches the ExpressVPN server. This adds an intermediary connection point and may be useful on networks that require or support proxy-based routing.
The feature is available through supported iOS and Android apps and requires Lightway TCP. Users must provide compatible HTTPS proxy details, and the feature should not be treated as a guaranteed method for bypassing every firewall or network restriction.
7. Lightway pros and cons
Lightway combines a compact Rust architecture, modern encryption, and fast reconnection features. However, its close integration with ExpressVPN and limited adoption outside the service reduce its flexibility compared with WireGuard and OpenVPN.
Pros
Lightweight Rust-based implementation
Fast connection and reconnection design
AES-256-GCM and ChaCha20-Poly1305 support
Open-source implementation
Independent security assessments
ML-KEM post-quantum protection
Cons
Primarily used within the ExpressVPN ecosystem
Less widely adopted than WireGuard or OpenVPN
Lightway Turbo is currently limited to Windows
Turbo cannot be used with split tunneling or Lightway TCP
Advanced options vary across platforms
Performance varies by network, server, and device
Lightway is particularly suitable for ExpressVPN users who value fast reconnection, mobile network switching, and newer security features. Its main limitation is ecosystem flexibility, as third-party support and community adoption remain more limited than those of WireGuard or OpenVPN.
8. Frequently asked questions
Is Lightway better than WireGuard?
Neither protocol is universally better. Lightway offers deeper ExpressVPN integration and faster session recovery, while WireGuard has broader industry adoption and third-party support.
Is ExpressVPN Lightway safe?
Yes, Lightway uses modern encryption and has undergone independent security assessments by Cure53 and Praetorian. ExpressVPN addressed the reported findings and submitted the documented fixes for further review.
Can I use Lightway on my router?
Yes, Lightway is supported on Aircove and compatible routers running ExpressVPN software. Router support depends on the hardware model and installed software version.
Is Lightway good for torrenting?
Yes, Lightway can be used for P2P file transfers through ExpressVPN. Actual performance depends on server distance, internet speed, network routing, and peer availability.
What should I do if Lightway UDP fails?
Try Lightway TCP if UDP is blocked, unstable, or repeatedly fails to connect. You can also return to Automatic, change servers, or test another available protocol.
Does Lightway reduce VPN speed?
Yes, Lightway may reduce internet speed because encryption and VPN routing add some overhead. The actual impact depends on server distance, congestion, device performance, and local network conditions.
Does Lightway drain the battery?
Lightway is designed to operate efficiently on mobile and battery-powered devices. However, battery usage still varies by device hardware, network quality, selected cipher, and usage conditions.
Is Lightway open-source?
Yes, Lightway’s Rust implementation is open-source and available for public inspection. However, most users access the protocol through ExpressVPN apps and router products.
9. Conclusion
For users asking what is Lightway protocol, it is a modern VPN protocol built around a compact Rust implementation, fast session recovery, and authenticated encryption. Features such as ML-KEM post-quantum protection and Lightway Turbo expand its security and performance capabilities, although these advantages do not make it universally better than WireGuard, OpenVPN, or every other alternative.
Its main trade-off is limited adoption outside the ExpressVPN ecosystem. Although the implementation is open-source, WireGuard and OpenVPN continue to offer broader third-party support, community adoption, and configuration flexibility. You can explore the VPN Guides section of Safelyo for additional protocol comparisons, setup instructions, and troubleshooting advice.
