WireGuard is a modern VPN tunnel protocol designed for simplicity, speed, and small code footprint — the 2020s default for most VPN services.
Explanation
WireGuard replaced OpenVPN as the default for most modern consumer VPNs because it is faster (kernel-space implementation on Linux, minimal handshake), simpler (4,000 lines of code versus OpenVPN's 100,000+), and easier to audit. It uses fixed modern cryptography (Curve25519, ChaCha20, Poly1305, BLAKE2s) with no negotiation — servers and clients agree on the crypto suite in advance. The downside for privacy-sensitive users is that WireGuard sessions are tied to a specific client public key, which is harder to rotate than OpenVPN certificates. WireGuard also does not natively hide its protocol signature — DPI systems in restrictive countries can fingerprint and block it. Obfuscation layers (like WireGuard-over-WebSocket) exist for that case.
Related terms