WireGuard in brief
- A modern protocol designed to be simple, fast and easy to audit, with a much smaller codebase than older VPN protocols.
- Uses a fixed set of modern cryptography (including ChaCha20, Poly1305 and Curve25519), so there are no weak options to misconfigure.
- Built into the Linux kernel and available on all major platforms.
- Reconnects quickly when you change networks, which suits phones.
OpenVPN in brief
- Long-established and open source, using TLS for key exchange and widely supported by VPN providers and routers.
- Highly configurable, with many cipher options.
- Runs over UDP (usually faster) or TCP. OpenVPN over TCP port 443 looks similar to normal secure web traffic, which can help on networks that block VPNs.
Privacy: the WireGuard IP question
Standard WireGuard keeps a peer’s IP address in server memory while connected, which privacy-focused providers address in different ways, for example with double-NAT systems or by assigning temporary addresses. Some providers’ own protocols, such as NordVPN’s NordLynx, are built on WireGuard for this reason. Others have developed their own protocols, such as ExpressVPN’s Lightway. Look for provider documentation and audits.
Which should you choose?
- Everyday use, streaming and mobile: WireGuard or the provider’s WireGuard-based protocol.
- Networks that block VPNs: OpenVPN over TCP, or your provider’s obfuscation mode.
- Routers: whichever your router supports; WireGuard often performs better on modest hardware.
Many apps have an “automatic” setting that picks for you, which is fine for most people. More on settings in VPN features explained.
Last updated: 13 October 2026
