WireGuard is a modern VPN protocol released in 2020 that has quickly become the default choice for premium VPN providers. It's faster, leaner and simpler than OpenVPN — while offering equally strong encryption.
How WireGuard works
WireGuard runs inside the Linux kernel (and as user-space modules elsewhere), using state-of-the-art cryptographic primitives instead of the wide algorithm choices of older protocols. The result is a tunnel that establishes in milliseconds and moves packets with very little overhead.
Its entire codebase is around 4,000 lines — small enough to be independently audited. OpenVPN, by comparison, is roughly 100× larger.
Encryption and security
WireGuard uses a fixed, modern cipher suite:
- 1ChaCha20Symmetric encryption, faster than AES on devices without hardware AES.
- 2Poly1305Message authentication to detect tampering.
- 3Curve25519Elliptic-curve key exchange.
- 4BLAKE2sFast, secure hashing.
- 5SipHash24Hash-table keys, resistant to hash-flooding attacks.
Why WireGuard is faster
Three reasons: it lives closer to the kernel (fewer context switches), it uses UDP with a minimal handshake (one round-trip), and its cipher choices are optimised for modern CPUs and mobile chips.
In our tests, WireGuard is consistently 20–40% faster than OpenVPN on the same server, and roams between Wi-Fi and mobile without dropping.
Privacy concerns and how providers solve them
Vanilla WireGuard stores client IPs statically on the server, which is a privacy issue for a commercial VPN. Providers work around this with a shim layer:
- 1NordLynx (NordVPN)Double NAT hides your assigned IP from the server.
- 2Lightway-DCO / WireGuard hybridExpressVPN's Lightway takes similar inspiration.
- 3Dynamic IP mappingMullvad, Proton and Surfshark rotate IPs per session.
Which VPNs support WireGuard
Almost every major provider now offers WireGuard by default: NordVPN (as NordLynx), Surfshark, ProtonVPN, Mullvad, IVPN, Private Internet Access, CyberGhost and TorGuard. ExpressVPN uses their in-house Lightway, which is architecturally similar.
When NOT to use WireGuard
In networks that block UDP entirely (some restrictive corporate or country firewalls), WireGuard can be unreachable. In those cases, fall back to OpenVPN over TCP 443, or use your provider's obfuscation protocol.
Frequently asked questions
QIs WireGuard secure?
Yes — it uses modern, peer-reviewed cryptography and has been independently audited.
QIs WireGuard faster than OpenVPN?
Yes, typically 20–40% faster with lower latency and battery use.
QCan WireGuard be blocked?
It uses UDP, which some restrictive networks block. Use OpenVPN TCP or obfuscation as a fallback.
QDoes WireGuard support both IPv4 and IPv6?
Yes, natively.
Related guides
Keep going down the rabbit hole 🐇
Ready to pick a VPN?
Compare the providers we have tested against every criterion in this guide.
See top VPNs