How our dedicated IP maintains anonymity

One primary benefit of using a VPN is getting a new IP address, hiding your real one from websites you visit. When you use ExpressVPN, the only information that a website or attacker can glean about your IP is that it belongs to ExpressVPN. Not only is a VPN IP shared by many users, but ExpressVPN also keeps no logs about who has used what IP address, protecting your anonymity. Furthermore, even if you connect to the same VPN server, there could be numerous IP addresses that you could be assigned in a randomized process. All these measures make it harder for anyone to track your activity online or tie your activity back to you.

But there are some cases where you want your IP to stay static while still protected by a VPN. For instance, when you need to connect to a company network remotely, your company might need to whitelist your IP address in its systems to give you access. This is where dedicated IP services come in: They assign a specific IP to you. This consistency can be convenient. But the clear downside of using a dedicated IP address is that your activity can be easily linked to you. One of the perceived privacy risks is that the service provider, in assigning the IP to you, can tie your IP to you.

What sets ExpressVPN’s dedicated IP service apart?

This year, ExpressVPN has begun rolling out a dedicated IP service as an add-on to our VPN subscriptions. And in its design, we set out to do something unique: creating a service where we cannot link the dedicated IP to the user. Just like with our VPN service, there is no way for someone to trace an IP address back to you, unless you reveal your identity (such as by signing in to a website), because even we do not know your dedicated IP. This means if a third party asks us for user data concerning a specific dedicated IP assigned by us, we would have no data to provide.

So despite a user being assigned a specific IP address that’s just for them, despite this IP being listed within their ExpressVPN app, despite regular payments for the subscription, despite having to manage users’ subscription statuses—we have no idea what IP is assigned to specific users. It’s no easy feat.

In our dedicated IP white paper, we dive deep into how we achieved this level of security and anonymity. For the slightly less technical among us, below is an overview of key techniques that make it work.

How we set out to design our dedicated IP

In creating our dedicated IP service, we are just as focused on privacy as ever. Here are the areas we focused on. We’re proud to say that we’ve achieved these goals in our final product.

Zero-knowledge IP allocation

We designed our IP allocation process in such a way that we will never know which IP each user is assigned. We ensure the user’s privacy is preserved both on allocation and on renewal.

Provable transparency

Despite the high levels of privacy and anonymity involved, we needed a system that allows third parties to independently verify that our service functions as described, assuring trust and accountability. ExpressVPN has built a transparent system where every action and process can be independently validated through public attestation without compromising the user’s identity. 

Excellent user experience

Despite the complexities of creating our dedicated IP service, it is easy to set up and start using your dedicated IP. Just choose a location, and an IP reflecting that location will be assigned to you. You will then be able to use this same dedicated IP across all your devices through the ExpressVPN apps for Android, iOS, Windows, with more platforms to come. 

The tech behind our zero-knowledge dedicated IP

In order to avoid associating a user’s identity with their IP during the dedicated IP assignment process, no single component can have access to both pieces of information simultaneously. To achieve this, we relied on the following processes and technologies. For a deeper dive, read our  white paper.

Blinded tokens. Blinded tokens are a key process for our zero-knowledge dedicated IP.  They are tokens issued by a server without the server knowing who the token is assigned to, while still allowing the token to be redeemed. They function like cash, which can be spent without revealing your identity.

AWS Nitro Enclaves. AWS Nitro Enclaves, part of Amazon’s virtual computers service, enables us to create isolated compute environments to further protect and securely process highly sensitive data. Unlike standard virtual machines, enclaves don’t have permanent storage or even network access; they can only communicate through a special dedicated interface known as VSOCK. Critically, Nitro Enclaves includes cryptographic attestation for software, allowing anyone to verify that the enclave is running what it claims to be running. 

Why use dedicated IP?

If you are seeking everyday privacy while browsing online, then using a VPN is a wise choice. But there might be certain times when having a stable IP address suits your needs more, without having to compromise the protection you get from a VPN. Some of the most common reasons include:

Accessing restricted networks. Many organizations implement IP whitelisting to limit access to important networks. A dedicated IP gives the user an address that the organization can add to its whitelist. With ExpressVPN’s dedicated IP solution, the user no longer has to choose between VPN privacy and accessing the network, as VPN encryption is still applied.

Smoother browsing. Some online services, such as online banking, corporate VPNs, and remote access systems, require the user to maintain heightened security on their device. Those systems often consider a changing IP as a sign of elevated risk. ExpressVPN’s dedicated IP addresses this problem by ensuring the user is always connecting not only from the same country and region but also from the same IP address—even if traveling or using different Wi-Fi networks. This significantly reduces the likelihood of triggering any IP-based security alerts.

Fewer CAPTCHA requests. CAPTCHA requests are inconvenient and can increase with the use of VPNs. Exclusive use of a single IP by one user allows servers to establish prolonged trust in that IP. With a dedicated IP, your browsing doesn’t have to be affected by how others behave, and you’ll still enjoy VPN protection.

Take back control of your IP privacy

Whatever your IP needs, we got you covered, with your privacy at the forefront of all consideration. Find out how our Shuffle IP feature keeps your IP changing in a randomized manner, adding another layer of tracking prevention. But if a static IP is what you need, use our dedicated IP add-on with peace of mind. Unless you tell someone your dedicated IP, no one can know who is using it, and that includes us.

Dedicated IP is available as an add-on to ExpressVPN service. New users are offered it as an add-on during checkout. Existing ExpressVPN subscribers can head to their Account page to add a dedicated IP to your subscription. (Dedicated IP is being rolled out in phases, and it might not be immediately available to you.)

Learn how to set up your dedicated IP. Once your dedicated IP is set up, you can switch between your dedicated IP and standard VPN service within the ExpressVPN app.