Most VPN apps list a protocol somewhere in their settings — WireGuard, OpenVPN, IKEv2, sometimes older ones like L2TP/IPsec or PPTP — and most users never touch it. That's usually fine, since a well-built app picks a sensible default. But the protocol is genuinely the part of a VPN doing the cryptographic heavy lifting, and the three modern options differ enough in design philosophy that it's worth understanding what you're actually getting.

OpenVPN: the flexible veteran

OpenVPN has been around since 2001 and is still widely used, for good reason — it's mature, extensively battle-tested, and extremely configurable. It can run over either TCP or UDP, supports a wide range of ciphers and authentication methods, and works almost anywhere, including on restrictive networks where other protocols get blocked, because its traffic can be made to look similar to ordinary HTTPS traffic.

That flexibility comes at a cost, though. OpenVPN's codebase is large — commonly cited around 100,000-plus lines of code — because it supports so many configuration paths, legacy cipher options, and platform quirks. Large codebases are harder to fully audit, and more code paths means more opportunities for implementation bugs, some of which have been found and patched over OpenVPN's long history (as they have been in most software of similar scale). It also tends to be slower than newer alternatives, particularly on mobile, both in raw throughput and in how long it takes to establish a connection.

IKEv2/IPsec: fast reconnects, mixed reputation

IKEv2, almost always paired with IPsec for the actual encryption, is a protocol built by Microsoft and Cisco and used heavily in enterprise VPNs and natively on iOS and some other mobile platforms. Its standout strength is connection resilience: IKEv2 is very good at automatically re-establishing a tunnel when your device switches networks — say, from Wi-Fi to cellular mid-walk — which OpenVPN historically handled less gracefully.

Its downsides are less about performance and more about trust and complexity. IPsec is a large, old standard with a long history of implementation vulnerabilities across different vendors' software, and — more specifically — parts of the IPsec ecosystem have been credibly implicated in historical intelligence-agency efforts to weaken VPN implementations, which has left a lingering trust question around some IPsec deployments even though the protocol itself, correctly implemented, is considered sound. It's also, like OpenVPN, a comparatively large and complex specification to implement correctly.

WireGuard: small, modern, and fast

WireGuard is the newest of the three, first stabilized around 2020 and since merged directly into the Linux kernel — itself a strong signal of how seriously the security community took its design. Its core idea is minimalism: instead of supporting a long menu of ciphers and legacy compatibility modes, WireGuard picks one modern, well-regarded cryptographic primitive for each job (ChaCha20 for encryption, Poly1305 for authentication, Curve25519 for key exchange) and doesn't offer alternatives. No negotiation, no legacy fallback, no configuration surface for a bug to hide in.

The practical result is a codebase of roughly 4,000 lines — small enough that independent researchers have been able to review essentially all of it, compared to sampling a fraction of OpenVPN's. Fewer lines of code isn't automatically "more secure," but it does mean a dramatically smaller attack surface and a much more tractable one to actually verify. WireGuard is also consistently faster in independent benchmarks, both in raw throughput and — noticeably on mobile — in how quickly it establishes a connection and how little battery it uses doing so, since it avoids a lot of the handshake overhead older protocols carry.

The tradeoffs are real, though: because WireGuard is deliberately minimal, it lacks some of OpenVPN's obfuscation tricks for evading network-level VPN blocking, and by default it's a bit more static about how it assigns client IP addresses within the tunnel, which server-side software has to handle explicitly (most modern implementations do this well, but it's a design difference from OpenVPN's more built-in flexibility here).

A quick note on the older protocols

You may still see L2TP/IPsec or PPTP listed in some older routers or corporate VPN setups. PPTP in particular is worth actively avoiding at this point — it's a genuinely old protocol (from the 1990s) with known, practical cryptographic weaknesses that make it unsuitable for anything privacy-sensitive today; it persists mainly because it's simple to set up and built into a lot of legacy hardware, not because it's still considered secure. L2TP/IPsec is a step up but shares much of IPsec's complexity and history. Neither is a serious option for a modern VPN app, which is why this comparison focuses on the three protocols that actually matter for that decision today.

Side-by-side

Why most modern consumer VPNs have moved to WireGuard

For the majority of VPN use cases — encrypting a phone or laptop's everyday traffic, switching between servers, staying connected while moving between networks — WireGuard's combination of speed, small attack surface, and battery efficiency outweighs OpenVPN's extra flexibility and obfuscation options for most users. That's the core reason it's become the default choice for newer VPN apps, including this one: it's not that OpenVPN or IKEv2 are broken, it's that WireGuard's minimalist design is a better fit for what most people actually need a VPN to do.