WireGuard vs OpenVPN

The short answer

A VPN protocol is the set of rules that two machines use to build the encrypted tunnel. WireGuard and OpenVPN are the two open-source protocols most consumer VPNs offer. Neither has a known practical break. WireGuard is simpler and newer. OpenVPN can run over TCP and is easier to disguise, which helps on networks that block VPNs. For background on all the protocols, see our VPN protocols explainer.

Why code size matters

Fewer lines of code means fewer places for bugs and a smaller job for anyone reviewing it. The WireGuard whitepaper states that the Linux implementation can be written in less than 4,000 lines of code, which it says makes it easy to audit. OpenVPN does far more. It supports many ciphers, authentication methods and options, and it relies on a full TLS library for its handshake. That flexibility is useful, but it means a much larger body of code to trust.

WireGuard was merged into the mainline Linux kernel for version 5.6. Donenfeld announced WireGuard 1.0.0 for Linux 5.6 on 30 March 2020. Getting into the kernel was a long process: the cryptography code had to be reworked first.

How their cryptography differs

WireGuard is opinionated. Its protocol page lists one fixed set of primitives: ChaCha20 with Poly1305 for encryption, Curve25519 for key agreement, BLAKE2s for hashing, SipHash24 for hashtable keys and HKDF for key derivation. The handshake is built on the Noise framework (Noise_IKpsk2). There's no negotiation. If one of these primitives were ever broken, the fix would be a new protocol version, not a configuration change. WireGuard's site says the key exchange gives perfect forward secrecy, with new handshakes every few minutes.

OpenVPN is flexible. It uses TLS to set up the session and then encrypts data with a negotiated cipher. In OpenVPN 2.6 the default data cipher list is AES-256-GCM, AES-128-GCM and, where the build supports it, ChaCha20-Poly1305. The two sides pick the first cipher on the server's list that the client also supports. That flexibility lets admins adapt, and it also means a badly configured server can use weak settings. Consumer VPN apps choose the settings for you, so check what your provider says it uses.

Audits and formal proofs

OpenVPN had two public audits of version 2.4 in 2017. Quarkslab's review was funded by the Open Source Technology Improvement Fund (OSTIF), and Cryptography Engineering's review was paid for by Private Internet Access. Quarkslab reported two remote denial-of-service bugs (CVE-2017-7478 and CVE-2017-7479), which OpenVPN fixed in versions 2.4.2 and 2.3.15 on 11 May 2017. Neither audit found a way to break the encryption.

WireGuard lists several formal verification efforts on its site. These are mathematical proofs that the protocol design has the security properties it claims. They include a Tamarin symbolic model by Donenfeld and Kevin Milner, a computational proof by Benjamin Dowling and Kenneth Paterson, and a CryptoVerif proof by Benjamin Lipp. Verified Curve25519 code from the HACL* and Fiat-Crypto projects is also listed. A proof covers the design, not every app built on it. A VPN company's own app still needs its own review.

The WireGuard privacy question: static internal IPs

WireGuard was designed for networks where each peer is known in advance. Each client has a public key, and the server keeps a list that ties each key to an internal IP address. For a commercial VPN that promises not to keep logs, that list is awkward: it's a record on the server that links a customer's key to an address, and a basic WireGuard server keeps it as long as the peer is configured. WireGuard's own known-limitations page also notes that if a server's private key were stolen and old handshakes had been recorded, an attacker could learn which peers had connected, though not what they sent.

Providers handle this in different ways, according to their own descriptions:

• NordVPN built NordLynx, a WireGuard-based setup with a double NAT system. NordVPN says every user on a server gets the same internal address in the first layer, and a second layer assigns per-session addresses that exist only while the session is active. TechRadar notes one consequence: you can't export a NordLynx configuration to use in other WireGuard apps or routers.
• Mullvad lets customers rotate their WireGuard key, and with it their internal IP address. In a September 2019 post Mullvad described manual rotation in its app, and a November 2019 post announced faster rotation of keys and addresses.
• Other providers publish their own explanations. Read each provider's own documentation and, where it exists, an independent audit. Our VPN audits tracker lists them.

Getting past VPN blocking

WireGuard only runs over UDP and makes no attempt to hide what it is. Its known-limitations page says obfuscation is left to a separate layer and that tunneling over TCP isn't supported because TCP-over-TCP performs badly. OpenVPN can run over TCP port 443, the same port as HTTPS web traffic, which some networks don't block. Many providers add their own obfuscated modes on top of either protocol. In countries that actively block VPNs, results change often. See are VPNs legal before you travel.

What about speed?

We don't publish speed numbers of our own. WireGuard's own performance page compares it with IPsec and OpenVPN, and it says plainly that its benchmarks are old and not well conducted, that WireGuard and IPsec have since become faster, and that in its view OpenVPN remains much slower. WireGuard running inside the Linux kernel avoids some overhead that OpenVPN's traditional user-space design has. Real-world speed depends more on the server's load, its distance from you and your own connection than on the protocol alone.

Which should you use?

• Default to WireGuard (or the provider's WireGuard-based protocol) on phones and laptops, if the provider explains how it avoids keeping key-to-IP records.
• Use OpenVPN over TCP, or the provider's obfuscated mode, when a network blocks WireGuard.
• Use OpenVPN if you need to set up a VPN on older router firmware that doesn't support WireGuard. See VPN on a router.

Neither protocol fixes a provider that keeps logs. The protocol protects data in transit. What the company does on its servers is a separate question, covered in no-logs policies explained.