This is VPN protocols explained without the jargon. A protocol is the set of rules your device and a VPN server follow to set up and run the encrypted tunnel, including how they prove identity, swap keys and package data. The protocol you use affects speed, reliability and compatibility, but all the well-known ones are designed to keep your traffic encrypted when implemented properly.
What a VPN protocol does
If you read our introduction to how a VPN works, you will remember that traffic travels inside an encrypted tunnel. The protocol defines how that tunnel is created and maintained. It covers three jobs.
- Authentication: confirming that the server is the one you meant to reach.
- Key exchange: agreeing on secret keys without sending them in the clear.
- Data transport: wrapping your traffic, encrypting it and carrying it across the network, usually over UDP or TCP.
Most VPN apps hide all of this behind a drop-down labelled something like “protocol” or “connection type”. Understanding the choices helps when a connection is unreliable or blocked on a particular network.
VPN protocols explained: the main ones you will meet
OpenVPN
OpenVPN is an open-source protocol that has been used for many years and has been examined extensively by security researchers. It relies on the TLS system also used by HTTPS websites to set up the connection. It is flexible: it can run over UDP, which is generally quicker, or over TCP, which can get through some restrictive networks more easily. It usually needs a separate app or client on the device, which most VPN apps include. The trade-off is that it is a large piece of software and can be somewhat heavier than newer designs.
WireGuard
WireGuard is a newer open-source protocol built around a small codebase and a fixed set of modern cryptographic choices. Its small size makes it easier to review and tends to make connections start quickly. It runs over UDP. One design point worth knowing is that its basic form keeps the peer addresses on the server for as long as a tunnel is active, so reputable services add their own measures to avoid keeping identifying records. This is another reason to read a provider’s privacy terms, which we discuss in our no-logs explainer.
IKEv2/IPsec
IKEv2 handles the key exchange and works with IPsec to protect the data. It is well regarded for handling network changes gracefully, such as when a phone moves from Wi-Fi to mobile data, because it can quickly re-establish the tunnel. Many phones and operating systems support it natively, which is convenient. Some networks block the ports it uses.
Older protocols
PPTP is an old protocol with well-documented weaknesses and should be avoided. L2TP/IPsec is still found, but it is generally less favoured than the options above. If an app offers only PPTP, treat that as a warning sign about the service.
Comparing them at a glance
| Protocol | Typical strengths | Typical drawbacks |
|---|---|---|
| OpenVPN | Long track record, very configurable, UDP or TCP | Larger codebase, can be slower than newer designs |
| WireGuard | Small, modern, quick to connect | UDP only, newer than the others |
| IKEv2/IPsec | Good at switching networks, built into many devices | Ports are sometimes blocked |
| PPTP | Simple | Known security weaknesses, avoid |
Real-world performance depends heavily on the provider’s servers, your own connection and the distance involved, so we do not claim that one protocol is always faster. Treat any strict ranking with caution.
How to choose in practice
For most people, the sensible approach is not to fiddle at all. Many apps have an automatic mode that picks a protocol suited to the network you are on, and it is a good default. If you want to choose yourself, these rules of thumb work well.
- Start with WireGuard or OpenVPN over UDP on a typical home or mobile connection.
- If the connection fails or drops on a particular network, try another protocol, since some networks interfere with specific ones.
- If you move between Wi-Fi and mobile data frequently, IKEv2 is worth a try for its quick reconnection.
- If you are on a restrictive network that only allows normal web traffic, OpenVPN over TCP sometimes works when the others do not.
- Avoid PPTP altogether.
Protocol is only part of the picture
A strong protocol will not rescue a poor service. How the provider handles logging, how it manages its servers and how well the app deals with dropped connections all matter just as much. For the last point, our guide to the VPN kill switch shows why a protocol that reconnects quickly is not a substitute for a safety net that blocks traffic when the tunnel fails.
Things to check in an app
- Whether the protocols are named openly, rather than described only as “secure” or “military-grade”.
- Whether open standards such as OpenVPN, WireGuard and IKEv2 are supported.
- Whether the app is kept up to date, since protocol implementations get security fixes like any other software.
- Whether there is an automatic option so you are not forced to guess.
Be wary of providers who promote a proprietary protocol as better than open standards without explaining how it can be independently checked. Open designs get far more public scrutiny.
Where to start
Leave the protocol on automatic, and only change it if you hit a problem. If you are still comparing services, read how to choose a VPN with protocol support as one item on your checklist, and explore the rest of our VPN basics section for the other settings you are likely to meet.
Frequently asked questions
Which VPN protocol is the most secure?
OpenVPN, WireGuard and IKEv2/IPsec are all considered sound when properly implemented. The service's overall practices matter at least as much as the protocol you pick.
Should I use UDP or TCP?
UDP is usually the better default for speed. TCP can help on restrictive networks that block UDP, but it may be slower.
Is PPTP safe to use?
No. It has known weaknesses and is best avoided in favour of OpenVPN, WireGuard or IKEv2.
Can I change protocol while connected?
Usually you disconnect, pick another protocol in the settings and reconnect. Most apps apply the new choice on the next connection.
