- ExpressVPN’s latest Android update adds three new ways to sign in: an email code, a login token, and a passkey.
- Login tokens expire after a short time and are replacing ExpressVPN’s old, never-changing activation codes.
- The options are rolling out gradually, and ExpressVPN expects every Android user to have them by the end of the year.
ExpressVPN has released a fresh version of its Android app, and it adds three new ways to sign in to your account directly in the app.
Users can now choose between a one-time code sent to their inbox, a login token copied from the ExpressVPN web portal, or a passkey.
The same options are already available on iOS, and ExpressVPN told TechRadar it’s using the switch to gradually retire activation codes altogether.
Three new ways to sign in to ExpressVPN on Android
The first option is the simplest. Enter the email address linked to your account, and ExpressVPN sends a verification code to your inbox.
The second option, a login token, is the bigger change. You generate one from the setup page of the ExpressVPN+ web portal, then paste it into the app or scan it as a QR code. Unlike the old activation code, which stayed the same and never expired, a new token is created each time you ask for one and expires after a short period.
The third option is a passkey. If you created one for your Android device when you signed up, you enter your email and follow the on-screen prompt to authenticate.
Email and password login isn’t going anywhere for now. You’ll still find it among the “legacy” options by tapping the ExpressVPN icon on the app’s welcome screen.
Activation codes, however, are the “first to make way for these newer methods,” according to an ExpressVPN representative.
Why this is good news for Android users
Passkeys are a big win, as they’re both more secure and easier to input than traditional passwords.
ExpressVPN’s version follows the FIDO2/WebAuthn standard, so a passkey synced through a passkey manager should work across your devices, while one saved on a hardware security key stays on that key.
The company is also encouraging users to store passkeys in its own password manager, ExpressKeys, which it says makes them available on iOS, Android, Mac, and in the browser.
Login tokens are also an improvement on the old activation code. Only someone already signed in to the portal can generate one, and because they’re time-limited, a token that’s lost or exposed simply stops working once it expires.
ExpressVPN still advises treating a token like a password: “don’t share it or post screenshots of it, and only scan the QR code on a device you own.” They’re handy, too, as setting up a new phone no longer means pecking out a long password on a touchscreen.
