WireGuard vs OpenVPN: Which VPN Protocol Should You Use?

WireGuard is the better default for most people. It has a much smaller codebase, fixed modern cryptography and a one-round-trip handshake. All twelve providers we track offer it. OpenVPN still earns its place when you need TCP on port 443 to get through a restrictive firewall, or for a router that only speaks OpenVPN. Both are secure when configured well.

A VPN protocol is the set of rules your app and the VPN server use to build the encrypted tunnel. The codebase is the program’s source code. A handshake is the opening exchange in which both sides prove who they are and agree on keys. A round trip is one message out and one reply back.

TCP is a way of sending data that confirms every packet arrived. A port is a numbered entry point on a server, and port 443 is the one secure websites use. A firewall is a filter that decides which traffic may pass.

Where the two protocols come from

OpenVPN is the older of the two. It is an open-source program, which means anyone can read its code. It runs in user space, the area where ordinary apps run, outside the core of the operating system. It reuses TLS, the machinery behind HTTPS, to check identities and exchange keys.

Its own documentation describes two modes. In static-key mode, both ends share a key made in advance. Commercial VPNs use TLS mode. In TLS mode, each side presents a certificate, which is a digital ID. A TLS session is set up with authentication in both directions. Fresh key material for the data channel is then generated and exchanged inside that session. As a result, no key is ever used in both directions.

OpenVPN carries that TLS control channel and the encrypted data stream together. The control channel manages the connection, and the data channel carries your traffic. OpenVPN can send the result over UDP or TCP. UDP sends packets without checking that each one arrives. The OpenVPN manual notes that TCP is usually somewhat less efficient, and copes less well with unreliable or congested networks. But TCP on port 443 is what gets through a network that only lets web traffic out.

WireGuard was designed from the opposite direction. Its design is set out in a whitepaper. The paper describes a layer 3 tunnel built as a kernel virtual network interface for Linux. Layer 3 is the level of the network where IP packets travel. The kernel is the core of the operating system. WireGuard aims to replace both IPsec and user-space, TLS-based tools like OpenVPN “while being more secure, more performant, and easier to use”. IPsec is an older family of standards for encrypting internet traffic.

A peer is either end of the connection. WireGuard identifies peers strictly by a public key, in the style of SSH. SSH is a common tool for logging in to remote computers. Each public key is a 32-byte Curve25519 point. A single round trip sets up session keys. A client can roam between IP addresses, from Wi-Fi to mobile data, without negotiating the connection again. The whole protocol sends its packets over UDP only. Our how a VPN works explainer covers what happens around the protocol. This page is about the protocol itself.

Code size and auditability

The clearest difference is size. The whitepaper states that WireGuard is implemented for Linux in less than 4,000 lines of code, “making it easily audited and verified”. An audit here is a security review of the code. The project’s site says WireGuard is meant to be comprehensively reviewable by a single person. It contrasts this with the IPsec and OpenVPN/OpenSSL codebases, where it says auditing is overwhelming even for large teams. OpenSSL is a TLS library. The whitepaper describes OpenVPN as “enormously complex, supporting the entire plethora of TLS functionality”. It says this exposes a lot of code to potential vulnerabilities.

That is a fair description of OpenVPN’s attack surface, but not of its track record. The attack surface is all the code an attacker could try to exploit. OpenVPN has been scrutinized for years. Its TLS mode also supports hardening that plain TLS does not. A pre-shared HMAC key can be added to the handshake packets. HMAC is a check code that proves a packet came from someone who holds the key. Without that key, an attacker cannot even start a TLS handshake.

OpenVPN 2.6 also documents a data channel offload module called ovpn-dco. It moves packet encryption into the kernel on Linux, FreeBSD and Windows. That narrows the user-space gap the whitepaper describes. The flexibility cuts both ways. An administrator can pick the cipher, key size and digest. The cipher scrambles the data, and the digest checks that it has not been changed. This choice also means there are configurations to get wrong.

Providers do not always run the reference code, meaning the official version. These three facts come from our provider records of 31 October 2026:

• NordVPN’s NordLynx is a WireGuard-based implementation.
• Mullvad’s Android app uses GotaTun, its own version of WireGuard written in the Rust programming language. Assured audited it in a report published on 6 March 2026.
• ExpressVPN’s Lightway is a separate protocol, rather than either WireGuard or OpenVPN. It is written in Rust on wolfSSL, a TLS library, and has an open-source core.

Cryptography: a fixed suite versus a negotiated one

WireGuard ships one set of primitives, the basic building blocks of its encryption, and no way to change them:

• ChaCha20-Poly1305 for authenticated encryption, defined in RFC 8439
• Curve25519 for the key agreement, defined in RFC 7748
• BLAKE2s for hashing
• HKDF for key derivation

Authenticated encryption scrambles data and detects any tampering. Key agreement lets two sides create a shared secret over an open network. Hashing turns data into a short fingerprint. Key derivation turns one shared secret into the separate keys a session needs.

WireGuard assembles these into the Noise IK handshake pattern. The handshake completes in one round trip. The protocol re-runs it every few minutes, so session keys rotate. Earlier traffic then stays protected if a key is later exposed. There is nothing to negotiate, so there is no cipher-suite setting to get wrong. If a primitive were ever broken, the fix would be a new protocol version, not a configuration change.

OpenVPN negotiates instead. The TLS handshake checks both ends with certificates and chooses the TLS cipher suite. A cipher suite is the set of methods both sides agree to use. The data channel cipher is then set by configuration. The OpenVPN 2.6 manual gives a default list of AES-256-GCM and AES-128-GCM. It adds ChaCha20-Poly1305 when the crypto library supports it.

What a provider actually deploys varies. Our records show this for 31 October 2026:

• NordVPN’s OpenVPN uses AES-256-GCM with a 4096-bit Diffie-Hellman key.
• Private Internet Access defaults to AES-128-GCM, with AES-256 optional, and an RSA-4096 handshake.
• Windscribe pairs AES-256-GCM with SHA512 authentication and an RSA-4096 handshake.

Diffie-Hellman is a method for agreeing on keys, and RSA is used here to prove identity. The ciphers are sound in every case. The difference is that with OpenVPN, the strength is a choice someone made. With WireGuard, it is not.

IKEv2 sits between the two. It is the key exchange for IPsec, defined in RFC 7296. Like TLS, it negotiates its algorithms. Like IPsec, it is a large specification. But it has one advantage neither of the others has: it is built into the operating system. Apple’s deployment documentation describes a built-in IKEv2 client on iOS, iPadOS, watchOS and visionOS. Apple’s managed Always On VPN feature is available for IKEv2. Ten of the twelve providers we track list IKEv2, mostly for their Apple apps or manual setups. Mullvad and Private Internet Access do not.

Speed: designed for, not yet measured

WireGuard was designed for speed:

• The Linux implementation lives in the kernel, so packets do not cross into user space to be encrypted.
• ChaCha20-Poly1305 is, in the project’s words, extremely fast in software on virtually all general-purpose CPUs. A CPU is the main processor in a computer or phone.
• The handshake costs one round trip.
• Roaming means a phone that switches from Wi-Fi to mobile data keeps its session instead of reconnecting.

OpenVPN’s design, as the whitepaper puts it, involves a long-lived daemon and context switching between kernel space and user space. A daemon is a program that runs in the background. Context switching is the work of moving between the kernel and ordinary apps. This is the overhead that ovpn-dco now removes on supported platforms.

Those are design facts, not measurements. We have not yet tested the throughput of either protocol in our lab. Throughput is the amount of data a connection carries per second. Speed is left out of our scores until we have tested it. This page will carry the numbers when our testing program produces them. Our methodology describes that program.

Privacy: WireGuard’s static keys and tunnel addresses

WireGuard’s simplicity has a privacy cost that OpenVPN does not share. Peers are identified by static public keys, which do not change. The cryptokey routing table ties each public key to the tunnel addresses it may use. So a server has to hold each client’s public key and assigned tunnel address for as long as that peer is configured.

The project’s own list of known limitations adds a subtler issue. The first handshake message encrypts the sender’s public key under the server’s static key. Suppose an attacker obtained a server’s private key and had logged past handshakes. They could then work out who had connected, though not what they sent. To reduce this risk, the project suggests rotating or regenerating keys. OpenVPN has no standing table of client keys. Each session is negotiated over TLS and given its addresses for as long as the session lasts.

Commercial providers have built their own answers, and this is where our records run out. NordVPN’s help center describes NordLynx as a WireGuard-based implementation. Mullvad’s record notes that its servers run from RAM with no persistent storage. RAM is working memory that is wiped when a server powers off. The record also notes that Mullvad’s logging policy covers IP addresses. But our provider data does not yet capture how each implementation assigns, stores and expires WireGuard peer keys. Your threat model is the set of risks you want protection from. If the server’s key table matters to yours, read the provider’s own protocol documentation before relying on WireGuard. Our no-logs explainer covers what a logging policy does and does not promise.

Obfuscation and restrictive networks

WireGuard does not try to hide. Obfuscation means disguising VPN traffic so it looks like something else. The project states that WireGuard “does not focus on obfuscation”. It says obfuscation should happen in a layer above it. It also explicitly does not tunnel over TCP, because of the poor performance of TCP inside TCP. Some networks block or slow down UDP, or fingerprint VPN handshakes to spot them. On those networks, plain WireGuard is the protocol most likely to fail.

OpenVPN’s TLS-based design is easier to disguise. That is why providers’ obfuscation modes are so often OpenVPN underneath:

• Windscribe’s Stealth wraps OpenVPN in TLS.
• Windscribe’s WStunnel puts OpenVPN inside WebSocket frames on port 443. WebSocket is a standard way for web pages to keep a connection open.
• Private Internet Access’s obfuscation adds an SSL layer, so the traffic looks like ordinary web traffic. SSL is the older name for TLS.

Providers that lean on WireGuard have added their own layers instead. These are as recorded on 31 October 2026:

• Mullvad offers UDP-over-TCP, Shadowsocks and QUIC transports for WireGuard. Shadowsocks is a proxy built to get past censorship, and QUIC is the transport behind newer web traffic.
• Proton VPN’s Stealth protocol tunnels WireGuard over TLS.
• NordVPN’s NordWhisper is a separate protocol for restrictive networks, and NordVPN’s obfuscated servers now run on it.
• ExpressVPN documents automatic obfuscation on every server.

If you are choosing a provider for a censored network, our best VPNs for China page compares these modes.

Post-quantum protection

Post-quantum protection is designed to resist attacks by future quantum computers. By default, WireGuard is not post-quantum secure. The project’s guidance is to run a post-quantum handshake on top of WireGuard. The result goes into WireGuard’s pre-shared key slot, a place for an extra secret that both sides hold in advance. Several providers now do exactly that, according to their records of 31 October 2026:

• Mullvad’s quantum-resistant tunnels use Classic McEliece and ML-KEM to derive the pre-shared key.
• IVPN’s use Kyber-1024 and Classic McEliece.
• Windscribe uses a hybrid X25519MLKEM768 handshake.
• Surfshark turns post-quantum protection on by default for WireGuard.
• NordVPN offers an opt-in post-quantum toggle that works only with NordLynx.

Classic McEliece, ML-KEM and Kyber are post-quantum key methods. Proton VPN lists post-quantum encryption as future work on its 2026 roadmap. hide.me’s October 2026 blog post notes that WireGuard’s default configuration is not post-quantum secure. None of the twelve records documents a post-quantum option for OpenVPN.

When to pick which

• Everyday use on a laptop or phone: WireGuard, or your provider’s WireGuard-based protocol. As NordLynx, it is the default in most of NordVPN’s apps. It is also the only protocol Mullvad runs.
• A network that blocks VPNs: OpenVPN over TCP on port 443, or your provider’s obfuscated mode, whichever protocol it is built on.
• A router or an older device: OpenVPN, the common denominator in router firmware. Firmware is the software built into a device. Mullvad and Proton VPN both supply WireGuard configuration files for routers, though.
• No third-party app allowed: IKEv2 through the operating system’s built-in client.
• A post-quantum requirement: a provider that documents a post-quantum layer on WireGuard, as listed above. ExpressVPN’s Lightway, which uses ML-KEM by default, is the other option. See ExpressVPN vs NordVPN for how the two approaches compare.

Whichever you pick, a kill switch matters more than the protocol for day-to-day privacy. A kill switch blocks your internet if the VPN connection drops. Split tunneling rules apply to every protocol equally. Split tunneling lets you choose which apps skip the VPN. More explainers are in the Learn hub. Every provider’s protocol record is linked from our reviews hub.

Related

• What is a VPN kill switch?
• What is split tunneling?
• How does a VPN work?
• Double VPN explained
• No-logs policies explained
• Best VPNs for China
• Mullvad review
• NordVPN review