ExpressVPN Android App Adds Passkey, Email Code and Token Sign-In

What happened

ExpressVPN has updated its Android app with three new ways to sign in: email code, login token and passkey. According to TechRadar, the changes are designed to make it quicker and safer for users to get protected on a new device without relying on a traditional password.

The update matters most for first-time setup. A user installing the app on a new handset has to prove who they are before any protection starts, and the choice of sign-in method shapes how smoothly that happens. Offering passkeys alongside one-time codes and login tokens gives users more than one route in, depending on their situation and the devices they already use.

The coverage available so far comes from a single report by TechRadar, which summarises the update at a high level. Details such as rollout timing, supported Android versions and how each method is set up are not set out in the material reviewed.

Why it matters

Sign-in is part of the customer journey, not a technical afterthought. Every extra step, password reset or verification code is a point where people can hesitate, make mistakes or abandon the task. Reducing that friction is one of the most direct ways a digital product can improve the experience from the first interaction.

Passkeys work differently from passwords. Instead of a shared secret that can be typed, reused or phished, they rely on a cryptographic key held on the user's device and confirmed locally. That shift benefits both sides: users get a faster login and the service gets a more secure one, and the security gain is not dependent on users remembering complex credentials.

The Renascence take

Most coverage of this kind treats a login upgrade as a feature checklist. The more useful question is how many people ever reach the protection they came for.

Authentication is where first impressions are formed, and most product teams still design it as a gate rather than a welcome. Offering several sign-in routes is sensible, but choice only helps when the default path is obvious and the fallback never feels like a dead end. Operators should measure where new-device users drop off during setup, then test whether passkeys, codes and tokens each remove a specific point of friction. If the change is not visible in completion rates, it is a security improvement that customers will never experience as a benefit.