VPN protocols explained

Most VPN apps have a protocol setting buried two screens deep with four acronyms in it, and almost nobody who opens that screen leaves better informed. So: the answer is WireGuard, and this page is why, plus the two situations where it is wrong.

What a protocol actually is

Two jobs: agree on encryption keys with the server, then wrap each packet so it can travel to that server and back. The protocol is the set of rules for both.

The differences that reach you as a user come down to three things. How much work each packet costs — which shows up as latency and battery. How quickly it can re-establish a dropped connection — which matters enormously on a phone that sleeps. And how easy it is for a network to recognise and block — which decides whether it works on a restrictive Wi-Fi at all.

WireGuard: the default answer

WireGuard is about 4,000 lines of code. OpenVPN is several hundred thousand. That is the whole story in one comparison: a smaller codebase is faster to run, easier to audit, and has fewer places for a bug to hide.

In practice you notice it three ways. Pages start loading fractionally sooner. Your phone reconnects the moment it wakes rather than after a visible pause. And the battery lasts measurably longer over a full day.

Every VPN in our ranking offers WireGuard or a variant. Several ship their own build:

• NordLynx (NordVPN) — WireGuard with a double-NAT layer, so no user IP needs storing on the server. This addresses WireGuard's one genuine privacy wrinkle, below.
• Lightway (ExpressVPN) — not WireGuard-based, built for very fast connection establishment, and open-sourced.
• Most others use WireGuard directly with their own handling of the same issue.

The wrinkle, stated honestly: WireGuard was designed for static point-to-point links, so by default it associates a fixed IP with your key on the server. That is a record a VPN provider would rather not keep. Every provider we rate has engineered around it — double NAT, key rotation, RAM-only servers that forget on reboot. It is worth knowing the problem exists and worth checking your provider says how it handles it; it is not a reason to avoid WireGuard.

OpenVPN: the one that gets through

Older, slower, and still the right answer sometimes.

OpenVPN runs in two modes and the distinction matters:

OpenVPN UDP — the faster of the two, and what you would use if WireGuard were unavailable. Still slower than WireGuard.

OpenVPN TCP on port 443 — the escape hatch. Port 443 is what HTTPS uses, so this traffic looks like ordinary encrypted web browsing to a firewall. Networks that block VPNs by port or protocol generally cannot block this without also blocking the web. It is noticeably slower — TCP inside TCP causes retransmission pile-ups under packet loss — but it works where nothing else does.

That is the case for keeping OpenVPN in the list: on a hotel Wi-Fi, a corporate network or a country that filters VPN traffic, it is often the difference between a connection and none.

The others, briefly

IKEv2/IPsec — genuinely good at one thing: surviving a network change. Move from Wi-Fi to cellular mid-call and IKEv2 reconnects seamlessly. Fast, natively supported on iOS. WireGuard now reconnects fast enough that this advantage has mostly evaporated, but IKEv2 remains a reasonable second choice on a phone.

L2TP/IPsec — old, slower, no reason to choose it when the above exist.

SSTP — Microsoft's, runs over TLS on 443 so it gets through firewalls. Proprietary and Windows-centric. OpenVPN TCP does the same job with more scrutiny behind it.

PPTP — do not use this. Broken since the 1990s and thoroughly so; the encryption can be cracked in hours with commodity hardware. It persists because it is built into Windows and old routers and it is easy to set up. Easy and safe are different properties.

Stealth / obfuscated modes — not a protocol exactly, but a wrapper (often over OpenVPN or WireGuard) that disguises the traffic as regular HTTPS. This is what you need in China, Iran, Russia or the UAE, and on networks that actively filter VPNs.

Which providers offer what

VPN	Stealth mode	Added ping	Avg speed	Kill switch
NordVPN	Yes	+4 ms	712 Mbps	Yes
Surfshark	Yes	+6 ms	655 Mbps	Yes
ExpressVPN	Yes	+7 ms	598 Mbps	Yes
Proton VPN	Yes	+9 ms	541 Mbps	Yes
Mullvad	Yes	+8 ms	590 Mbps	Yes
PIA	Yes	+10 ms	480 Mbps	Yes
Windscribe	Yes	+14 ms	445 Mbps	Yes

What to actually set

On every device, for everyday use: WireGuard (or NordLynx / Lightway).

Check it is set explicitly. "Automatic" is not a synonym. Several apps fall back to OpenVPN on networks where they cannot establish WireGuard quickly, and they do not always say so. If speed matters to you, look at the setting rather than trusting the default.

Keep a fallback in mind. If a network refuses to connect at all, switch to OpenVPN TCP or turn on the stealth mode. That is the sequence — do not start there, because you would be paying for compatibility you do not need.

On a router: whatever the firmware supports well. Many older routers only do OpenVPN, and running it there is fine — the router's CPU is usually the bottleneck rather than the protocol.

The one-line version

Set WireGuard. If something blocks it, use OpenVPN TCP or stealth. Never PPTP. That is the entire decision, and the rest of this page exists so you know why rather than because the choice is complicated.