VPN Encryption: AES-256 vs ChaCha20, Which and Why

VPN encryption almost always comes down to one of two ciphers: AES-256 or ChaCha20-Poly1305. Both are considered unbreakable in practice, so the real question isn't which is stronger — it's which suits your device. This guide explains what these ciphers do, when each is faster, and why the phrase 'military-grade encryption' tells you nothing.

First, a reminder from our main guide to VPN protocols: the cipher is not the protocol. WireGuard, OpenVPN and IKEv2 are protocols; AES-256 and ChaCha20 are the ciphers that run inside them.

What VPN encryption actually does

A VPN cipher scrambles your data so anyone intercepting it sees meaningless noise, and it does one more thing modern ciphers all include: it authenticates the data, proving it wasn't altered in transit. Ciphers that do both are called AEAD — Authenticated Encryption with Associated Data. AES-256-GCM and ChaCha20-Poly1305 are both AEAD ciphers.

The '256' in AES-256 refers to a 256-bit key: the number of possible keys is 2 to the power of 256, a figure so vast that brute-forcing it is considered infeasible for any foreseeable computer. ChaCha20 uses a 256-bit key too. In both cases, the key length is far beyond the point of being the weak link.

AES-256: the hardware-accelerated standard

AES (the Advanced Encryption Standard) was standardised by the US institute NIST in 2001 and is the most widely used cipher in the world — it protects everything from web traffic to disk encryption. Its big advantage is hardware acceleration: most modern processors, from laptops to phones, include dedicated AES instructions (Intel and AMD call theirs AES-NI) that make AES extremely fast. OpenVPN and IKEv2 typically default to AES-256-GCM.

ChaCha20: faster where there's no AES hardware

ChaCha20-Poly1305, designed by cryptographer Daniel J. Bernstein and standardised in RFC 8439, is the cipher WireGuard uses. Its key property: it is fast in plain software, with no special hardware needed. On devices that lack AES acceleration — some older phones, cheaper routers and low-power gadgets — ChaCha20 is typically much faster than software AES and uses less battery. That is precisely why WireGuard, built for efficiency, chose it.

On hardware that does have AES acceleration — most current computers and flagship phones — the two ciphers perform similarly, and you would struggle to tell them apart.

So which should you choose? (Usually: don't)

Here is the honest decision rule. Neither cipher is stronger for practical purposes — both are considered secure. If your device has AES hardware (most do), AES-256 and ChaCha20 are effectively tied on speed. If it doesn't, ChaCha20 wins on speed and battery. In almost all cases you don't need to choose: your protocol already picks a sensible default — WireGuard uses ChaCha20, OpenVPN and IKEv2 use AES-256 — and that default is fine.

This is the one place the cipher touches real-world speed, which we also cover in the fastest VPN protocol.

Why 'military-grade encryption' is marketing

You will see VPNs advertise 'military-grade AES-256 encryption'. It sounds impressive and means almost nothing. AES is a public standard published by NIST; the same cipher secures your online banking and the messaging app on your phone. Governments do use AES-256, but so does everyone else — it is not a special military product. When a provider leads with that phrase, it is describing the cipher, not the quality of its protocol, its no-logs policy, or its servers.

A useful filter: if a VPN's headline security claim is just 'AES-256', it's telling you what everyone has, not what makes it good. Look at the protocol and the audited no-logs record instead.

The takeaway

Both AES-256 and ChaCha20 are secure; the difference is hardware, not strength. Trust your protocol's default, and judge a VPN on its protocol and privacy record rather than a cipher name every provider shares. For the layer that carries the cipher, return to our guide on which VPN protocol to use.

Beyond the cipher: keys and forward secrecy

The cipher is only one part of VPN encryption. Before any data is scrambled, the two ends have to agree on a secret key without an eavesdropper learning it — a job done by a key exchange, typically using Curve25519 or a similar elliptic-curve method. Good VPN setups also provide forward secrecy: the keys are ephemeral and rotate regularly, so even if one were exposed, it couldn't unlock earlier traffic. WireGuard rotates its keys roughly every two minutes for exactly this reason.

This is why "AES-256" on its own is an incomplete description of a connection's security. The strength of the whole system depends on the key exchange, the authentication and the freshness of the keys as much as on the cipher's name. A modern protocol handles all of this for you; the cipher is just the most marketable piece of it.

Are these ciphers future-proof?

Against today's computers, both AES-256 and ChaCha20 are far beyond brute force and expected to stay that way for the foreseeable future. The longer-term question people raise is quantum computing. The reassuring part is that symmetric ciphers like AES-256 and ChaCha20 are considered relatively resilient to quantum attacks — a future quantum computer would weaken them, but 256-bit keys are chosen with a wide safety margin precisely for that reason.

The part more exposed to quantum attacks is the key exchange, which is why some providers have begun adding "post-quantum" protection to that step. For now this is an emerging feature rather than a decision factor: the cipher itself is not the weak link, and for everyday privacy the standard modern setup is entirely sufficient.

The single most useful habit here is to stop treating the cipher as the headline. Both AES-256 and ChaCha20 are excellent, your protocol picks the right one for your hardware, and no consumer needs to override that default. What actually varies between VPNs is the protocol, the key exchange, the freshness of the keys and the provider's audited record — none of which fit on a marketing badge. Read past the cipher name, and you'll judge encryption on the things that genuinely differ.