WireGuard
Modern VPN Protocol
The VPN protocol that rewrote the rulebook: a few thousand lines of code, modern cryptography, and speed that leaves older protocols behind. It is fast becoming the default for new VPNs.
WireGuard is a modern, open-source VPN protocol built from scratch to be fast, simple, and secure. It runs over UDP and deliberately rejects the complexity of older protocols: instead of dozens of configurable cipher options, it uses a single, fixed set of state-of-the-art cryptographic algorithms. The result is a codebase of just a few thousand lines — small enough to be audited thoroughly — compared with the hundreds of thousands in OpenVPN or IPsec.
Why it is fast
WireGuard's performance edge comes from several design choices working together:
- Lean code means less processing per packet and the ability to run inside the operating-system kernel, where it is most efficient.
- Modern cryptography chosen for speed as well as security.
- UDP transport avoids the overhead of running a tunnel over TCP.
- Fast roaming: it reconnects almost instantly when you switch from Wi-Fi to cellular, because it identifies peers by key rather than by a fragile session.
In practice this usually means higher throughput, lower added latency, and quicker connection setup than the older protocols.
How it compares
| WireGuard | OpenVPN | IPsec | |
|---|---|---|---|
| Codebase | Tiny (~4k lines) | Large | Large |
| Speed | Fastest | Moderate | Fast |
| Transport | UDP | UDP or TCP | UDP/ESP |
| Config complexity | Very low | High | High |
The privacy nuance
WireGuard's one wrinkle for commercial VPNs is that it assigns each client a fixed internal IP address and keeps a little state about peers — which, left raw, could reveal which user held which address. Reputable VPN providers solve this with extra systems layered on top (dynamic address assignment and no-logging designs), so in practice WireGuard-based commercial VPNs deliver strong privacy. For self-hosted and site-to-site use, the fixed addressing is a feature, not a concern.
Where you will encounter it
WireGuard has spread rapidly: most major commercial VPN apps now offer it (often under their own branding), it is built into the Linux kernel and available on every major OS, and it is the backbone of many self-hosted setups and mesh-VPN products. If you are choosing a protocol today and have no specific reason to use something else, WireGuard is usually the best starting point for the blend of speed, simplicity, and security. The main reasons to pick OpenVPN instead are its TCP mode for slipping through restrictive firewalls and its longer track record in legacy environments.