Definition
Point-to-Point Tunneling Protocol was developed by Microsoft and partners in 1995 and was the first widely deployed VPN protocol. It was built into Windows from version 95 onward and supported on virtually every device for years afterward. Its broad compatibility, low overhead, and easy configuration kept it in use long after it was technically obsolete.
Why It Is Insecure
PPTP relies on the MS-CHAP-v2 authentication protocol, which has been demonstrably broken for over a decade. Tools like ASLEAP and chapcrack can recover the user's password from captured PPTP traffic in hours on commodity hardware. The encryption itself, MPPE with RC4, was also marginal and is now considered broken. Any encrypted PPTP traffic captured today should be assumed to be readable by a moderately resourced attacker.
Status
PPTP has been removed from modern operating systems (Apple removed it in macOS Sierra in 2016; iOS dropped it the same year). It should never be used for any communication where confidentiality matters. It is included in glossaries because it still appears in old corporate VPN documentation and ancient networking equipment, and users sometimes encounter it without realizing how broken it is.
In Practice
If a router, NAS or old office system offers only PPTP, treat that as a sign to upgrade rather than a setting to use. Microsoft itself has advised against PPTP for years, and its MS-CHAPv2 authentication can be cracked offline. Replace it with WireGuard, IKEv2/IPsec or OpenVPN.