Definition
WireGuard is a VPN protocol developed by Jason A. Donenfeld, first released in 2016 and merged into the Linux kernel in 2020. It was designed as a clean-slate replacement for IPSec and OpenVPN, prioritizing simplicity, performance, and modern cryptography. Where OpenVPN's codebase runs to hundreds of thousands of lines, WireGuard's core is roughly 4,000 — small enough to be audited thoroughly. The cryptographic primitives (Curve25519, ChaCha20-Poly1305, BLAKE2s) are hard-coded; there is no negotiation, no cipher suite selection, no version downgrades.
Performance and Simplicity
WireGuard is markedly faster than OpenVPN in real-world tests, particularly on mobile devices and routers with weaker CPUs. It uses ChaCha20 for encryption, which performs well in software without relying on AES-NI hardware. Its handshake completes in one round trip, and reconnection is near-instant. Configuration is simpler: each peer is identified by a public key, with no certificate authority infrastructure required.
Adoption
Most major commercial VPN providers now offer WireGuard, sometimes branded as their own protocol (NordLynx is NordVPN's WireGuard implementation; Lightway is ExpressVPN's own, separate protocol, built on the wolfSSL library rather than on WireGuard). Mullvad, ProtonVPN, IVPN, Surfshark, and others offer WireGuard natively. Limitations remain: WireGuard does not natively support obfuscation (a problem in censorship-heavy environments) and assigns each peer a static IP within the tunnel by default (a privacy concern that providers solve by rotating per-session).