WireGuard

WireGuard is the set of rules a VPN app uses to build an encrypted tunnel between your device and a VPN server. It was released in 2020 as a deliberate rethink of older protocols such as OpenVPN and IPSec, which had grown large and complicated over decades.

Its defining feature is size. OpenVPN runs to roughly 100,000 lines of code; WireGuard is around 4,000. That matters more than it sounds: less code means fewer places for bugs to hide, and a codebase small enough that security researchers can actually read all of it.

Why it feels faster

• It runs closer to the hardware. WireGuard can operate inside the operating system kernel, so traffic is not constantly shuffled between system layers.
• Connections start almost instantly. The handshake takes a single round trip, so switching servers feels immediate rather than taking several seconds.
• It survives network changes. Moving from Wi-Fi to mobile data does not drop the tunnel — useful on a phone that changes network all day.
• It is easier on the battery, because it only does work when data is actually moving.

How the encryption is arranged

WireGuard does not let you choose from a menu of ciphers the way OpenVPN does. It picks one modern, well-regarded set and uses it everywhere. That sounds restrictive, but it removes a whole class of misconfiguration, and if a weakness were ever found the protocol version is simply replaced rather than patched around.

Each side has a public and a private key, exactly like SSH. Your device and the server exchange public keys once, then recognise each other instantly on every future connection. Traffic travels over UDP, which is quicker than TCP but can be blocked on restrictive networks — which is why providers still keep OpenVPN available as a fallback.

The privacy catch, and how providers solve it

Plain WireGuard was designed for connecting your own machines, not for running a commercial VPN. To route traffic it assigns each connected device a fixed internal IP and keeps it on the server — which, left alone, would be a record linking a user to a session.

Reputable VPN providers work around this rather than ignore it, typically by adding a layer that assigns addresses dynamically and discards them, or by keeping the whole system in RAM so nothing survives a reboot. Several ship it under their own name — NordLynx at NordVPN, for example — precisely because it is modified WireGuard rather than the stock protocol. If a provider offers WireGuard, it is fair to ask how they handle this.

Should you use it?

For most people, yes — it is the best default in almost every VPN app today, and the speed difference is genuinely noticeable on fast connections. Switch to OpenVPN only if WireGuard is blocked on the network you are using, since OpenVPN can disguise itself as normal HTTPS traffic in a way WireGuard cannot.