vpn

WireGuard vs OpenVPN: Speed Is the Easy Part, the Real Difference Is What Each One Remembers

secure-os· Updated September 4, 2026· 5 min read #vpn#protocols#privacy#performance

Close-up of a dense fibre patch panel, rows of white connectors clipped into turquoise plates with thin turquoise and yellow cables fanning out in every direction against a dark blurred background

Almost every comparison of these two ends at speed, and on that point there is no argument: WireGuard is faster, on nearly every connection, by a margin you can feel. If that were the whole story there would be nothing left to write.

It is not the whole story. The two protocols made opposite bets, and the interesting question is what each one gave up.

The size difference, and why it matters more than benchmarks

OpenVPN carries two decades of accumulated options. It speaks over TCP or UDP, supports a long list of ciphers, and can be configured in ways its own authors probably never anticipated.

WireGuard is deliberately tiny. A few thousand lines of code against several hundred thousand, one modern cipher suite, no negotiation, no options to get wrong.

That is not a performance decision, it is an auditability decision. A codebase small enough to be read end to end by one person has a different risk profile from one that is not, regardless of how fast either runs.

Speed follows from the same choice. Less code in the path, no cipher negotiation, and on Linux it runs in the kernel rather than shuttling packets to and from user space.

Where OpenVPN still wins, and it is not nostalgia

It hides. OpenVPN can run over TCP on port 443, which looks like ordinary HTTPS traffic to anything watching casually. WireGuard is UDP only, with a distinctive shape, and networks that block it can do so easily.

This matters in exactly one situation: a network that objects to VPNs at all. Hotel and airport captive portals, some corporate networks, and countries that filter. If you have ever had a VPN simply fail to connect from a hotel room, this is usually why.

It is everywhere. Older routers, embedded devices and legacy corporate gear support OpenVPN and will never support anything else. That is a real constraint, not a preference.

A dark data centre aisle lit in cold blue, a small computer monitor sitting on a white worktop in the centre while a tangle of pale blue cables hangs from the racks above and behind it

A rack aisle with cables hanging in no particular order above a single screen. The picture is a fair portrait of the difference: one protocol grew by accumulation over twenty years, the other was written once and kept deliberately small.

The privacy detail nobody mentions in the speed tests

Here is where the comparison stops being technical and starts mattering.

WireGuard, by design, keeps your assigned internal IP address associated with your key on the server. The protocol has no built-in concept of a session that ends and forgets. Left alone, a server holds a small piece of information that links a key to an address, which is precisely the kind of record a no-logs policy is supposed to make impossible.

⚠️ This is not a flaw you can fix from the client side. Providers solve it with additional machinery, usually a system that assigns addresses dynamically and wipes the association, and the honest ones document it. When choosing a provider that offers WireGuard, that documentation is the thing worth reading, not the speed chart.

OpenVPN has no equivalent quirk. Its session model ends when the session ends.

What neither of them does

Neither hides that you are using a VPN from your own provider. Both are recognisable as VPN traffic, and obfuscation is a separate layer sold under separate names.

Neither protects you from a login. A protocol encrypts the tunnel. It does nothing about the account you sign into at the other end, which is why the choice matters far less than people assume once the basics are in place. Our page on what a VPN actually does covers that boundary in detail.

Neither decides what goes through the tunnel. That is a routing question, and if some applications should bypass the VPN entirely, split tunnelling is the mechanism, independent of which protocol is underneath.

How to choose, in one paragraph

Use WireGuard by default. It is faster, it reconnects instantly when you move between networks, it drains less battery on a phone, and its small codebase is a genuine advantage rather than a marketing line. Pick a provider that explains what it does about the address association.

Keep OpenVPN for the cases WireGuard cannot serve: a network that blocks it, hardware that does not support it, or a situation where looking like ordinary HTTPS traffic is the point. Most good providers ship both, and switching is a dropdown rather than a decision you are stuck with.

⚠️ And a note on IKEv2, which people ask about in the same breath: it survives network changes well and is well supported on mobile, but it sits between the two on every axis rather than beating either. It is a reasonable fallback, not a reason to skip this choice.

The short version

WireGuard is faster and much smaller, which buys auditability as well as speed.
OpenVPN can look like ordinary HTTPS, which is why it still wins on hostile networks.
WireGuard associates your key with an internal address on the server. Your provider has to solve that, and should say how.
Neither hides that you use a VPN, and neither protects an account you sign into.
Default to WireGuard, keep OpenVPN as the fallback, and stop optimising the protocol once both are available to you.