Last updated: July 2026. Written by Morgan Logan.
Most VPN apps let you choose your protocol. Most users leave it on automatic and never think about it again. That is usually fine. But when something goes wrong, a slow connection, a block on a hotel network, a kill switch firing too often, the protocol is often the reason. This guide explains what each VPN protocol actually does, the tradeoffs between them, and which to use for specific situations.
For context on what a VPN actually does before the protocol comes into play, start there.
What a VPN Protocol Actually Is
A VPN protocol is the set of rules that governs how an encrypted tunnel is established between your device and a VPN server. It determines how the two endpoints authenticate each other, how encryption keys are exchanged, how data packets are formatted and transmitted, and how the connection recovers from interruptions. The protocol is distinct from the encryption cipher: AES-256 encryption runs on top of whatever protocol you are using. Changing the protocol does not change whether your traffic is encrypted; it changes how that encryption is implemented and maintained. Different protocols make different tradeoffs between speed, security, auditability, and the ability to function on restrictive networks. WireGuard prioritizes a minimal codebase and speed. OpenVPN prioritizes flexibility and compatibility. IKEv2 prioritizes fast reconnection on mobile. PPTP prioritized speed at the cost of security, which is why it is now considered broken.
The 6 VPN Protocols You Will Encounter
WireGuard
WireGuard is the current standard for most VPN use cases. It was merged into the Linux kernel in 2020 and has since been adopted as the default or primary protocol by NordVPN, Mullvad, ProtonVPN, and most other major providers.
The technical case for WireGuard is straightforward: its codebase is approximately 4,000 lines, compared to OpenVPN's 70,000+. A smaller codebase means a smaller attack surface and, critically, a codebase that can actually be audited by independent researchers in a reasonable amount of time. In our testing across Windows 11 and Android 15, WireGuard retained 90-92% of baseline connection speed, higher than any other protocol we measured.
One genuine limitation: WireGuard's base design assigns a static IP address to each user session, which creates a potential privacy concern. Providers address this differently. NordVPN's NordLynx implementation adds a double NAT layer. Mullvad rotates IP assignments. If you are using stock WireGuard without a provider-level privacy layer, that is worth understanding.
OpenVPN
OpenVPN has been the industry standard since 2001. It runs in two modes: UDP for speed and TCP for reliability and network traversal. On a normal home connection, the difference between the two is small. On a restrictive network, a hotel, a corporate firewall, a country-level filter, OpenVPN TCP is often the only protocol that gets through, because it runs on port 443, the same port as HTTPS.
The codebase is large by modern standards, which makes auditing difficult. What it has instead is 25 years of real-world deployment and scrutiny. Known vulnerabilities have been found and fixed over that time. For users on networks that block WireGuard or IKEv2, OpenVPN TCP remains the most reliable fallback.
In our testing, OpenVPN UDP retained approximately 80% of baseline speed. OpenVPN TCP ran slower, around 70%, due to its more reliable but higher-overhead transmission method.
IKEv2/IPSec
IKEv2 (Internet Key Exchange version 2) runs over IPSec and is built into the networking stack of iOS and macOS natively. Its main advantage is connection handling on mobile: IKEv2 was designed to reconnect quickly when a device switches between networks, which is why it handles the Wi-Fi to cellular handoff better than older protocols.
On iOS specifically, IKEv2 is a solid default if WireGuard is not available. The limitation is auditability: IKEv2 implementations vary by platform and provider, and the closed-source nature of some implementations makes independent verification harder than with WireGuard or OpenVPN.
L2TP/IPSec
L2TP (Layer 2 Tunneling Protocol) tunnels traffic through IPSec encryption. It is slower than IKEv2 and offers no meaningful advantage over WireGuard or OpenVPN. Some older routers and devices default to it when IKEv2 is not available. Use it only as a last resort when no better protocol is offered.
PPTP
PPTP (Point-to-Point Tunneling Protocol) is deprecated and should not be used for any privacy purpose. The MS-CHAPv2 authentication used by PPTP has been broken since the 1990s, and tools to decrypt PPTP traffic are publicly available. It still appears in some consumer routers and low-cost VPN apps. If your VPN provider offers only PPTP, that is a reason to find a different provider. The only scenario where PPTP is acceptable is bypassing a simple geographic restriction where traffic privacy is genuinely not a concern.
Proprietary Protocols
Several major providers have developed proprietary protocols on top of open standards:
NordLynx (NordVPN) is WireGuard with a double NAT system that addresses the static IP privacy issue. Performance is comparable to standard WireGuard. Cure53 has audited NordLynx.
Lightway (ExpressVPN) is built on wolfSSL rather than OpenSSL. It has been independently audited by Cure53 and performs comparably to WireGuard in our testing. The codebase is open-sourced on GitHub.
Nexus (Surfshark) routes connections through a mesh network using WireGuard as the underlying protocol. It performs well in testing but has less independent audit history than NordLynx or Lightway.
Being proprietary does not make a protocol unsafe. What matters is whether an independent audit has been published and whether the provider has a verified no-logs policy. All three named above meet that bar. See our NordVPN review and Mullvad VPN review for full test results.
Protocol Comparison
VPN protocols differ primarily in speed, security auditability, and network compatibility. Based on Privaroo testing across Windows 11, Android 15, macOS Sequoia, and iOS 18 in July 2026: WireGuard retained 90-92% of baseline connection speed and showed the lowest mobile battery drain (approximately 15% less over a 4-hour standardized workload than IKEv2). OpenVPN UDP retained approximately 80% of baseline; OpenVPN TCP approximately 70% due to its higher-overhead transmission. IKEv2 performed comparably to OpenVPN UDP on stable connections but handled mobile network transitions faster. PPTP is deprecated with known cryptographic vulnerabilities and should not be used for privacy. Proprietary protocols, NordLynx, Lightway, Nexus, are each built on WireGuard or WireGuard-adjacent architectures, have published independent audits, and perform comparably to standard WireGuard in testing. Auto-select mode (the default in most VPN apps) typically tries WireGuard first and falls back to OpenVPN if WireGuard is blocked.
| Protocol | Speed | Security | Auditability | Best for |
|---|---|---|---|---|
| WireGuard | Fastest | Excellent | Small codebase | Daily use, mobile |
| OpenVPN UDP | Medium | Excellent | Well-reviewed | Reliability, older devices |
| OpenVPN TCP | Slower | Excellent | Well-reviewed | Bypassing restrictive networks |
| IKEv2/IPSec | Fast | Good | Varies | Mobile, iOS native |
| L2TP/IPSec | Medium | Mediocre | Limited | Last resort only |
| PPTP | Fast | Poor | N/A | Never for privacy |
Which Protocol to Use for Your Situation
The right protocol depends on what you are trying to accomplish, not on which one sounds most impressive.
For daily use on a home connection: WireGuard (or NordLynx/Lightway if your provider offers it). Fastest speeds, lowest battery drain, smallest codebase. No reason to use anything else when it is available and working.
On a hotel, airport, or corporate network that blocks the VPN: OpenVPN TCP on port 443. This is the most reliable protocol for getting through restrictive firewalls because port 443 traffic is rarely blocked. If you find your VPN frequently disconnects or fails to connect on travel networks, switch to OpenVPN TCP manually before connecting.
On iOS switching frequently between Wi-Fi and cellular: WireGuard handles this well on modern iOS. IKEv2 is also a solid choice here. Either is preferable to OpenVPN, which can be slower to re-establish after a network change.
For torrenting: WireGuard. The speed advantage is real, and the lower overhead means less CPU and battery impact during long download sessions. The VPN kill switch interaction matters here too: WireGuard reconnects in under 2 seconds when the tunnel drops, which minimizes the window where the kill switch has to block traffic. OpenVPN TCP can take 5-15 seconds to reconnect.
If your provider offers only PPTP or L2TP: Change providers. These are not adequate for privacy use in 2026.
For the related question of what happens when the protocol drops and whether split tunneling affects which protocol your specific apps use, see our VPN split tunneling guide.
How to Change Your VPN Protocol
Every major VPN app exposes protocol selection in settings, though the label varies:
NordVPN: Settings > VPN Protocol. Options: NordLynx (recommended), OpenVPN UDP, OpenVPN TCP.
Mullvad: Settings > VPN settings > Tunnel protocol. Options: Automatic, WireGuard, OpenVPN.
ProtonVPN: Settings > Connection > Protocol. Options: Smart (auto), WireGuard, OpenVPN UDP, OpenVPN TCP, IKEv2.
ExpressVPN: Settings > Protocol. Options: Automatic, Lightway UDP, Lightway TCP, OpenVPN UDP, OpenVPN TCP, IKEv2.
The auto-select or smart mode in each app will try WireGuard first. On most connections, that is correct. Override it manually only when you have a specific reason: a restrictive network, a particular speed issue, or a compatibility problem. After switching, verify the VPN is working correctly with a leak test; see our VPN leak test guide.
Does the Protocol Affect VPN Speed?
Yes, measurably. In our testing on NordVPN, switching from NordLynx (WireGuard-based) to OpenVPN TCP on a 500 Mbps connection produced a 22-percentage-point drop in speed retention. On a slower connection (100 Mbps), the gap was smaller but still noticeable.
The practical impact depends on what you are doing. For browsing, the difference between WireGuard and OpenVPN UDP is invisible. For large file transfers, video streaming at high bitrates, or torrenting, the protocol choice has real-world impact.
On mobile, WireGuard's battery efficiency is a meaningful advantage for always-on VPN use. In our 4-hour standardized mobile test, WireGuard drew approximately 15% less battery than IKEv2 on the same tasks. If you run a VPN continuously on your phone, that adds up.
Frequently Asked Questions
What is the safest VPN protocol?
WireGuard and OpenVPN are both considered cryptographically secure with no known exploitable vulnerabilities in current implementations. WireGuard's smaller codebase makes independent security auditing more feasible. OpenVPN has 25 years of deployment history and scrutiny. Either is a sound choice. PPTP is not safe and should not be used.
Is WireGuard better than OpenVPN?
For most users on most connections, yes. WireGuard is faster, uses less battery on mobile, and has a codebase small enough to audit properly. OpenVPN has one advantage WireGuard lacks: TCP mode on port 443, which bypasses restrictive networks that block WireGuard. For daily use on a normal connection, WireGuard is the better default. For travel on unpredictable networks, OpenVPN TCP is the reliable fallback.
What VPN protocol does NordVPN use?
NordVPN's default is NordLynx, which is WireGuard with a double NAT layer added to address the static IP privacy limitation of standard WireGuard. OpenVPN UDP and TCP are also available in settings.
Are proprietary VPN protocols safe?
NordLynx and Lightway have both been audited by independent security firms (Cure53) with public reports. Lightway's source code is published on GitHub. Being proprietary does not mean unsafe: the audit trail and no-logs verification matter more than whether the protocol is open source. All three major proprietary protocols (NordLynx, Lightway, Nexus) are built on WireGuard or WireGuard-adjacent foundations.
What is the difference between UDP and TCP in OpenVPN?
UDP (User Datagram Protocol) sends packets without waiting for confirmation of receipt. It is faster but less reliable on poor connections. TCP (Transmission Control Protocol) confirms each packet before sending the next. It is slower but more reliable, and because it runs on port 443, it bypasses most network-level VPN blocks. Use UDP by default; switch to TCP on restrictive networks.
