Built With Rust: ExpressVPN
Rebuilding a Security-Critical VPN Protocol for the Multicore Era
Built With Rust is a series from the Rust Foundation, spotlighting how Rust Commercial Network member organizations and Rust Foundation corporate members are using Rust to solve real engineering problems, in their own words. Each entry looks at the challenge a team faced, what they built in Rust to address it, and what changed as a result.
This installment features ExpressVPN.
About ExpressVPN
Since 2009, ExpressVPN has empowered millions of users to take control of their internet experience. The company’s consumer VPN service is powered by Lightway, its open-source, post-quantum VPN protocol, now implemented in Rust and independently audited by Cure53 and Praetorian, while ExpressVPN’s wider products have been vetted by third-party experts including PwC, Cure53, and KPMG.
The Challenge: scaling a security-critical protocol across cores without the risks of manual memory management
Lightway’s original implementation was a compact C core library, with its reference client and server built on libuv for event-driven networking. Single-core performance was excellent, but as gigabit and multi-gigabit connections became standard, ExpressVPN needed to make better use of modern multicore hardware.
Getting there in C would have meant taking on far more manual management of memory, object lifetimes, shared state, and synchronization – the exact areas where mistakes in a security-critical VPN protocol turn into data races, buffer overflows, use-after-free defects, memory corruption, or crashes that are difficult to reproduce. The codebase was also getting harder to evolve as new features and platforms were added. ExpressVPN needed a safer, more maintainable foundation, without giving up performance to get it.
What They Built: an open-source Rust workspace, with unsafe code denied by default
Rather than translating the existing C implementation line by line, ExpressVPN reimplemented Lightway as an open-source Rust workspace. It includes the lightway-core protocol library, reference client and server applications, shared application utilities, UniFFI bindings for integrating with applications on other platforms, and extensive unit, integration, and end-to-end testing infrastructure.
The client and server run on Tokio’s multithreaded asynchronous runtime, letting connection handling and network I/O get scheduled safely across worker threads and available CPU cores. Rust’s ownership model, borrow checker, and Send/Sync constraints catch many memory-safety, lifetime, and concurrency errors at compile time, without a garbage collector.
ExpressVPN also set a strict policy around unsafe Rust: it’s denied by default across the entire workspace. Where it’s genuinely required, such as at low-level interfaces with wolfSSL, libc, or OS networking facilities, it’s narrowly scoped and explicitly documented, with lint configuration that rejects any undocumented unsafe block. These boundaries were specifically examined by independent security auditors.
Rust didn’t replace Lightway’s cryptographic foundations. The protocol still uses the established wolfSSL library behind a carefully controlled interface, retaining support for TLS 1.3, DTLS 1.3, and post-quantum key establishment using ML-KEM.
The Results: nearly 4x the throughput, independently audited
- Two independent security audits, every finding resolved. Cure53 identified five findings (including one exploitable denial-of-service vulnerability); Praetorian identified two low-risk findings. ExpressVPN addressed all of them, and both firms validated the fixes through retesting. Cure53 concluded that Rust’s memory-safety features had been effectively leveraged; Praetorian specifically recognized the secure, disciplined use of unsafe Rust.
- Up to 2x the speed on Aircove routers, ExpressVPN’s dedicated router hardware.
- Nearly 4x the throughput on iOS, measured in internal benchmark testing during the 2026 rollout — achieved with a standard Rust release build, before any architecture-specific CPU optimization.
- Lightway in Rust began rolling out to ExpressVPN’s iOS users in May 2026, moving the project from an audited reimplementation to deployment on one of the company’s largest mobile platforms.
“Rust let us improve safety and performance together. It gave us a stronger model for multicore concurrency and delivered nearly four times the throughput of our previous C implementation on iOS, even before platform-specific optimisation.”
– Pete Membrey, Chief Research Officer at ExpressVPN and creator of Lightway
Why This Matters: proof that memory safety and performance aren’t a tradeoff
Lightway’s Rust implementation is published under the AGPLv3 license, so source code, protocol documentation, reference client and server, testing infrastructure, and nightly builds are all publicly available. The original C implementation remains public too, for research and comparison, while active development has moved to Rust.
For a protocol securing millions of users’ traffic, “safer” and “faster” are usually presented as a tradeoff. ExpressVPN’s results argue otherwise: independently audited memory safety, and a throughput gain large enough to matter on both constrained router hardware and modern mobile devices, from the same rewrite. The Rust codebase is also the foundation for continued performance work, including Lightway Turbo, which uses multi-lane tunnelling to send more data in parallel.
Final Takeaways
ExpressVPN’s Lightway reimplementation is a useful example of Rust being applied in a demanding environment: security-critical networking software exposed to hostile traffic and deployed as part of a large consumer service. The important point is not that Rust made the system secure by itself. Rust’s memory-safety and concurrency model, combined with Tokio’s multithreaded runtime, gave the team a safer foundation for multicore execution. The resulting implementation was then subjected to independent source-code review, dynamic security testing, remediation and retesting.
The project also demonstrates a disciplined approach to unsafe Rust Unsafe code is denied by default, exceptions are confined to small and explicitly documented boundaries, and those boundaries were specifically examined by independent auditors. wolfSSL remained the cryptographic implementation, showing that a team can improve the safety and maintainability of the surrounding system without replacing a mature cryptographic dependency that already performs its role well.
For teams maintaining performance-sensitive, security-critical C systems, the most transferable lesson is the engineering process rather than any single Rust feature. ExpressVPNchose a deliberate reimplementation, established strict linting and unsafe-code policies early, retained wolfSSL behind carefully reviewed bindings, and commissioned two independent audits rather than relying on Rust’s compiler guarantees alone.
The performance result is also significant. On iOS, the Rust implementation delivered nearly four times the throughput of the previous C implementation using a standard release build, before platform-specific optimisation. This demonstrates that moving to a memory-safe implementation did not require a performance trade-off, while still leaving scope for further platform-specific work.
Have a Rust Story to Tell?
ExpressVPN shares its story here as a member of the Rust Commercial Network, the Rust Foundation’s community for organizations building in production with Rust to connect with peers doing the same.
Separately, organizations that want to directly support the maintainers, security audits, and infrastructure the Rust ecosystem depends on can become a Rust Foundation corporate member. RCN participation and corporate membership are independent. Organizations are welcome to join either, or both.
