WireGuard Explained: How the Modern VPN Protocol Works

WireGuard is a modern VPN protocol designed to be fast, simple and easy to audit. If your VPN app has a protocol menu, WireGuard is almost certainly in it — and for most people it is the right choice to leave switched on. This guide explains what it is and how it works, without assuming you're a network engineer.

The short version: WireGuard does the same job as older protocols like OpenVPN, but with a fraction of the code and a single set of modern encryption. That design is why it is both faster and easier to trust.

What is WireGuard?

WireGuard is an open-source VPN protocol first released in 2019 and merged into the Linux kernel in version 5.6 in 2020 — a rare stamp of approval that put it inside the operating system itself. It was created by security researcher Jason A. Donenfeld with one guiding idea: strip a VPN down to the essentials so there is less that can go wrong.

The headline number is its size. WireGuard is roughly 4,000 lines of code, compared with the hundreds of thousands behind OpenVPN and IPsec once you count their dependencies. A smaller codebase is not just tidier — it means far fewer places for security bugs to hide, and a body of code small enough for researchers to read end to end.

How WireGuard works: the handshake

WireGuard builds a connection with a brief handshake based on the Noise Protocol Framework, a well-analysed design for setting up encrypted channels. Your device and the server each hold a key pair; they exchange public keys, and from that exchange both sides independently compute the same secret session key. Nothing that could decrypt your traffic is ever sent across the wire.

Those session keys are ephemeral and rotate roughly every two minutes, which gives WireGuard forward secrecy: even if a key were somehow captured, it could not be used to unlock traffic from earlier in the session. Once the handshake is done, WireGuard just moves encrypted packets — there is no heavy ongoing negotiation.

Why WireGuard is so fast

WireGuard is the fastest mainstream protocol, and the reasons are structural rather than magic. Running inside the kernel means encrypted packets take a shorter path through your system than a protocol running as a separate program. The lean codebase adds little overhead per packet. And because it uses only UDP — a connectionless transport that fires packets without waiting for acknowledgements — it avoids the delays that slow other options down.

We don't publish our own throughput figures, because we haven't run controlled tests and any single number is specific to one server on one day. But WireGuard's advantage shows up consistently in independent testing across the industry, and it is most noticeable on long-distance connections and on lower-powered devices.

The cryptography it uses

WireGuard is what its author calls "cryptographically opinionated": instead of letting you negotiate algorithms, it fixes one modern set. It uses ChaCha20-Poly1305 for encryption, Curve25519 for the key exchange, and BLAKE2s for hashing. There are no weak options to accidentally enable, and no negotiation step for an attacker to downgrade. If you want to understand the cipher itself, see our guide to VPN encryption: AES-256 vs ChaCha20.

The trade-off is that changing the cryptography means updating WireGuard itself rather than flipping a setting. In practice that is a feature: it keeps every WireGuard connection on the same known-good ciphers.

WireGuard's one privacy caveat

There is one honest caveat worth knowing. WireGuard's base design assigns each connected device a stable internal IP address, and the server keeps a table linking devices to those addresses. On a personal server that is fine; on a commercial VPN with a no-logs promise, storing that mapping would undercut the promise. Providers solve it in software — NordVPN's NordLynx, for example, wraps WireGuard in a "double NAT" system so the server never has to store who had which address. That NordVPN link is an affiliate link; it doesn't change what we write.

This is why WireGuard being "secure" and a WireGuard-based VPN being "private" are two slightly different questions. We dig into it in is WireGuard secure.

Should you use WireGuard?

For the full field, including when to switch away from WireGuard, see our guide to which VPN protocol to use. The main alternative is covered in OpenVPN explained.

Where you'll find WireGuard, and how to turn it on

In most commercial VPN apps, WireGuard is already the default or sits one tap away in the protocol menu. Sometimes it appears under a provider's own name rather than "WireGuard" — NordVPN lists it as NordLynx, and other providers wrap it similarly — but underneath it is the same protocol. If your app offers "Automatic" and "WireGuard", either is usually fine; Automatic normally means WireGuard unless the network forces a fallback.

You can also run WireGuard yourself. It ships as a free official app for Windows, macOS, Linux, iOS and Android, and it is a popular way to reach a home network or a self-hosted server. Many home routers support it too, which lets you protect every device on your network at once. Running it yourself is where WireGuard's static-IP behaviour is a non-issue — there is no shared server and no no-logs promise to keep, because the server is yours.

The one-line summary against the older protocols: WireGuard does what OpenVPN and IKEv2 do, with a fraction of the code, one fixed set of modern ciphers, and less overhead. That is why it went from a new project in 2019 to the default protocol across the industry in just a few years — a pace of adoption almost unheard of for a security protocol.