For most people, WireGuard is the better default: it is newer, simpler and designed for speed, and the major VPN apps now offer it, with several using it or a version of it by default. OpenVPN is still useful when you need TCP to get through a restrictive network, or a very widely supported option for routers and manual setups.
This guide explains how the two protocols differ, what each is good at, and how VPN companies are using them.
Table of Contents
- 1WireGuard vs OpenVPN at a Glance
- 2How WireGuard Works
- 3How OpenVPN Works
- 4The Limits WireGuard Admits
- 5Which Protocols VPN Apps Use Now
- 6Which Should You Use?
- 7Frequently Asked Questions
- Is WireGuard faster than OpenVPN?
- Is WireGuard more secure than OpenVPN?
- Why does OpenVPN still exist?
- Does WireGuard work over TCP?
- What is NordLynx?
WireGuard vs OpenVPN at a Glance
| WireGuard | OpenVPN | |
|---|---|---|
| Design | Small, modern codebase with a fixed set of cryptography | Mature, highly configurable, built on TLS |
| Encryption | ChaCha20 and Poly1305, Curve25519, BLAKE2s, Noise handshake | Configurable ciphers through its TLS library |
| Transport | UDP only | UDP or TCP |
| Getting past blocks | No built-in obfuscation | TCP mode can get through some networks that block UDP |
| Auditability | Designed to be reviewable by one person | Much larger codebase |
| Where it runs | Linux kernel, Windows, macOS, BSD, iOS, Android | Almost every platform and many routers |
How WireGuard Works
WireGuard is built to be simple. Its documentation lists a fixed set of modern cryptography: ChaCha20 for encryption, authenticated with Poly1305; Curve25519 for key exchange; BLAKE2s for hashing; and a handshake based on the Noise protocol framework. There are no cipher choices to get wrong.
That simplicity is the point. WireGuard’s project says it is meant to be implemented in very few lines of code and easily audited, contrasting itself with the far larger codebases of IPsec and OpenVPN with OpenSSL. It started in the Linux kernel and is now available on Windows, macOS, BSD, iOS and Android. Its project describes it as high-performance, which is a design goal rather than a measured result for your connection.
How OpenVPN Works
OpenVPN is the older and more flexible option. It is open source, with a community edition and clients for most platforms, and it runs over UDP or TCP. Its flexibility lets administrators choose ciphers and options, which is useful for compatibility but means more settings to configure correctly.
Its TCP mode is the practical reason many people still use it. Some networks, such as workplace, hotel or school Wi-Fi, block unusual UDP traffic. OpenVPN over TCP can often get through where a UDP-only protocol cannot.
The Limits WireGuard Admits
WireGuard’s own known-limitations page is candid about the trade-offs:
- No TCP mode. WireGuard deliberately does not tunnel over TCP, because of the poor performance of TCP inside TCP. Converting it to TCP is left to other tools.
- No obfuscation. WireGuard does not try to hide that it is WireGuard, so networks using deep packet inspection can spot and block it. Obfuscation is meant to sit in a layer above it.
- Other documented trade-offs, covering areas such as identity hiding, forward secrecy and post-quantum security, which the page explains in detail.
VPN companies fill these gaps themselves. Proton VPN offers WireGuard over TCP as well as UDP, plus its own Stealth protocol for getting past blocks. NordVPN’s default, NordLynx, is built on WireGuard, and it offers NordWhisper for restrictive networks, as covered in the NordVPN review.
Which Protocols VPN Apps Use Now
| VPN | WireGuard | OpenVPN | For restrictive networks |
|---|---|---|---|
| Proton VPN | Yes, UDP and TCP | Linux app only | Stealth; Smart Protocol picks automatically |
| NordVPN | NordLynx (WireGuard-based, default in most apps) | Yes | NordWhisper |
| Surfshark | Yes | Yes | Obfuscated servers, NoBorders mode |
| CyberGhost | Yes | Yes | Not covered here |
The trend is clear: WireGuard or a version of it is now the default, and OpenVPN is becoming the fallback. Proton VPN’s documentation now lists OpenVPN only in its Linux app, while its other apps use WireGuard and Stealth, with Smart Protocol choosing automatically by default.
Which Should You Use?
| Your situation | Use |
|---|---|
| Everyday use on a phone or laptop | WireGuard or your app’s WireGuard-based default |
| The network blocks or slows VPNs | Your app’s obfuscated mode, or OpenVPN over TCP |
| A router or device that only supports OpenVPN | OpenVPN |
| You are not sure | Leave the app on automatic |
Both protocols are considered secure when properly configured, so the choice is mostly about reliability on your network rather than safety. If one keeps dropping or will not connect, switch to the other in your app’s settings.
To compare providers, see the best VPN services comparison, or read is a VPN worth it first. You can check current plans at Proton VPN or Surfshark. Affiliate links: I may earn a commission at no extra cost to you.
Frequently Asked Questions
Is WireGuard faster than OpenVPN?
It is designed to be, with fast cryptography and a lightweight design, and VPN companies promote it for speed. Real results depend on your network, server and device, and this article did not run its own test.
Is WireGuard more secure than OpenVPN?
Both are considered secure when set up properly. WireGuard’s advantages are a fixed set of modern cryptography and a codebase small enough to audit easily.
Why does OpenVPN still exist?
It supports TCP, which can get through restrictive networks, and it runs on almost every platform and many routers.
Does WireGuard work over TCP?
Not by itself. WireGuard uses UDP only, but some providers, including Proton VPN, offer WireGuard over TCP through their own layer.
What is NordLynx?
NordVPN’s protocol built on WireGuard, and the default in most of its apps.
Affiliate disclosure: some links on this page are affiliate links, so I may earn a commission if you buy, at no extra cost to you.
