WireGuard vs OpenVPN: Which One Should You Use?

You open your VPN app’s settings and find a choice you did not ask for. Or you are setting up a VPN on a computer at home, and every guide picks a different option. WireGuard vs OpenVPN is a choice a lot of people run into, and most answers bury it in jargon.

Both are VPN protocols. A VPN protocol is the method a VPN app uses to build its encrypted tunnel, and most apps let you pick one in the settings. The trade-off is fairly simple. WireGuard is built to be faster and simpler ^[1]. OpenVPN has more ways to get through a picky network ^[4].

The short answer: choose WireGuard if you want speed and easy setup on networks that let it through. Choose OpenVPN if you often connect from strict hotel, office or school Wi-Fi, or if you run a VPN for a large group. This comparison is based on the projects’ own documents and published research, not on our own testing.

The quick comparison

	WireGuard	OpenVPN
Speed in everyday use	Built to be much faster, its makers say ^[1]	The slower one in that comparison ^[1]
Works on strict hotel or office Wi-Fi	One way of connecting, no backup if it is blocked ^[1]^[3]	Can switch to a way that most networks allow ^[4]
Effort to set up	Designed to be simple ^[1]	More choices to make about keys and logins ^[4]
Works on your devices	Windows, Mac, Linux, iPhone and Android ^[1]	Most major systems ^[4]
Privacy quirk to know	Each user can keep a fixed address unless the provider adds a fix ^[6]	Better at hiding who connected, on this one point ^[6]
Many users on one server	Not covered	Built for hundreds or thousands of users ^[4]

Which one is faster?

WireGuard, at least on paper. Its makers say it is meant to be considerably faster than OpenVPN ^[1]. That is a design goal from the people who built it. Our research did not include an independent speed test, so treat it as their claim.

In practice, if your VPN feels slow, switching the app to WireGuard is the first thing worth trying. If it does not feel faster for you, nothing is lost. Switch back.

When does OpenVPN win here? When WireGuard cannot connect at all. A slower connection beats no connection, and that leads to the next question.

Which one works on more networks?

OpenVPN, because it has a fallback and WireGuard does not.

WireGuard sends all its traffic over UDP ^[1]. UDP is a fast way of sending internet traffic that some strict networks, like hotel or office Wi-Fi, block. WireGuard has no second way to fall back on. Its makers left out the other common way of sending traffic on purpose, because running it inside a tunnel performs badly ^[3]. WireGuard also makes no effort to disguise itself as normal traffic. It leaves that job to other tools ^[3].

OpenVPN can run either way ^[4]. It can also work through the go-between servers that some offices put in front of their networks ^[4]. If one way is blocked, you can often switch to the other in the app settings.

So if you travel a lot or work from places with locked-down Wi-Fi, keep OpenVPN as a backup. If WireGuard will not connect on a hotel network, switch your app to OpenVPN and try again. If you mostly connect from home and your phone’s mobile data, you can probably skip this section.

Which is easier to set up on your own server?

WireGuard, by design. Its makers wanted it to be about as easy to set up as the standard tool people use to log in to a server from afar ^[1]. It was also added to the core of Linux starting with version 5.6 ^[2], so on a recent Linux server there can be less to install.

OpenVPN gives you more choices, and that means more decisions. You can set it up with one shared secret key, or with certificates for the server and each device ^[4]. A certificate is a digital ID card that proves a server or person is who they claim to be. The business version, OpenVPN Access Server, lets the admin list encryption options in order of preference so older devices can still connect ^[5]. It also changes the session’s encryption key at regular intervals ^[5].

When does OpenVPN win? When you run a VPN for a big group. It is built to scale to hundreds or thousands of users ^[4]. Our research did not cover how WireGuard handles groups that size, so we cannot call that one. For a home server shared with a few family members, this will not come up.

Which one is better for privacy?

OpenVPN, on one specific point. This is the WireGuard quirk worth knowing, and it has two parts. Mullvad described both on the WireGuard mailing list in 2019 ^[6].

The stolen key problem

Each WireGuard device has a private key, the half of a key pair you keep secret. The server has one too. If someone records WireGuard traffic and later steals the server’s private key, they can link past connections back to the same user ^[6]. The risk here is linking: knowing that many connections came from the same person. Mullvad wrote that on this point WireGuard offers worse privacy than OpenVPN ^[6].

There is a simple fix on the app side. A WireGuard app that uses a new key for every connection gets the same identity protection as OpenVPN ^[6].

The fixed address problem

WireGuard does not hand out addresses on its own, so each user keeps a fixed IP address inside the VPN unless the provider adds a workaround ^[6]. An IP address is the number that identifies your connection on the internet, a bit like a return address on a letter. A fixed one makes it easier to tie one user’s sessions together.

Proton VPN is one provider that built a workaround. Its apps start every WireGuard connection with the same internal address, 10.2.0.2 ^[7]. A second layer of address swapping then gives each session a random one ^[7].

OpenVPN has a small leak of its own. Both protocols send their tunnel session numbers unencrypted ^[6].

What should you do? If you use a commercial VPN with WireGuard, check whether the provider explains how it handles both problems. If it says nothing, ask, or use OpenVPN. On your own server, we think the quirk matters much less. You run the server and you already know which devices are yours. Your main job is keeping the server’s private key safe and the server up to date.

Which works on more of your devices?

It is a tie for most people. WireGuard started on Linux and now runs on Windows, Mac, iPhone and Android ^[1]. OpenVPN runs on most major operating systems ^[4]. If you own a normal phone and laptop, both will work.

OpenVPN wins if an older router or gadget only lists OpenVPN in its settings. In that case, use what the device supports.

Which should you pick?

Jake uses a commercial VPN on a phone

Jake connects from home and on mobile data, and the VPN app offers both options. Use WireGuard. Pick a provider that explains how it deals with the fixed address and stolen key problems above.

Sarah travels for work

Sarah connects from hotels, airports and client offices every week. Set WireGuard as the default and keep OpenVPN one tap away in the app. When a network blocks WireGuard, switch for that session.

Mike runs a server at home

Mike wants to reach a home photo backup from a phone, for a family of four. Use WireGuard. It is designed to be simple to set up ^[1], and on a recent Linux system it is already part of the core ^[2].

Emily manages access for a whole office

Emily needs a VPN for a few hundred staff, and some of them have older laptops. Look at OpenVPN. It is built for hundreds or thousands of users ^[4], and Access Server can keep older devices connecting ^[5]. This is also where a blog post stops being enough. Bring in someone who runs VPNs for a living.

Common mistakes

Thinking a VPN makes you anonymous. A VPN is a service that sends your internet traffic through an encrypted tunnel to another computer, so your network sees the tunnel and not the sites you visit. The VPN company is now the one in a position to see where you go. Neither protocol changes that.
Giving up on WireGuard after one bad network. A blocked hotel network says more about the hotel than about WireGuard. Switch to OpenVPN there and switch back later.
Choosing a provider only because it offers WireGuard. Ask how it handles fixed addresses ^[6]. A provider that has thought about it will usually say so in its own help pages.
Using one key for every device on your home server. Give each phone and laptop its own key. If a phone gets lost, you remove that one key and everything else keeps working.
Changing settings you do not understand. The defaults in a well-known app are fine for most people. Pick the protocol and leave the rest alone.

Pick one and get on with your day

Open your VPN app now and set the protocol to WireGuard. If it ever fails to connect, switch to OpenVPN for that network. You can ignore the rest of the settings menu.

For the technically curious

WireGuard’s makers say its code can be reviewed in full by one person, while the OpenVPN and OpenSSL codebases are so large that auditing them is an overwhelming task even for big teams ^[1]. In 2020, WireGuard had about 4,000 lines of code, while OpenVPN had more than 100,000 lines not counting OpenSSL ^[2]. OpenVPN relies on the OpenSSL library for much of its encryption ^[4].

WireGuard wraps IP packets in UDP ^[1] and explicitly does not support TCP, because tunneling TCP inside TCP performs badly ^[3]. OpenVPN supports TCP or UDP transport, including through proxies or NAT ^[4]. TCP is the common way of sending internet traffic that almost every network allows, at some cost in speed.

The linking problem Mullvad described comes from WireGuard’s lack of identity hiding forward secrecy. A stolen server static private key lets an attacker decrypt recorded handshakes and correlate every connection made with the same client static key ^[6]. Proton VPN’s answer to the fixed address problem is double NAT, which provisions sessions dynamically behind the shared 10.2.0.2 address ^[7].