WireGuard vs OpenVPN vs AmneziaWG, in one page

Three protocols cover almost every real situation. The right one depends on whether your network is filtering.

WireGuard - the default

About 4,000 lines of code against OpenVPN's several hundred thousand, which makes it far easier to audit. It connects almost instantly, survives switching between Wi-Fi and mobile data, and is easier on battery. On any network that is not actively filtering VPNs, use it.

Its weakness is that it is easy to recognise. The handshake has a distinctive shape, and deep packet inspection can spot it in milliseconds.

AmneziaWG - WireGuard in a disguise

A fork that keeps WireGuard's cryptography but changes what the traffic looks like: padded packets, decoy handshakes, per-server parameters so there is no single signature to block. You lose a little speed and gain the ability to connect at all in filtered networks.

VLESS / Reality - the heavy option

Rather than disguising the traffic, this class of protocol makes the connection resemble an ordinary TLS session to a real website. It is the most resilient approach and the fiddliest to run. It is where people end up when AmneziaWG starts being detected too.

OpenVPN - the compatibility case

Slower and older, but supported by hardware that predates WireGuard - some routers offload it in hardware. In heavily filtered countries it is effectively dead: its handshake is among the easiest to fingerprint.

How to choose

• Normal network: WireGuard.
• VPN blocked or throttled: AmneziaWG first; VLESS/Reality if that stops working.
• Old router: OpenVPN, if the firmware leaves you no choice.

We ship WireGuard and AmneziaWG profiles on the same key, so switching is a matter of importing a different config - see the setup guides .

Cypher VPN - no account, paid in crypto

Three locations, unlimited data, from $1.99 a week or $4.99 a month.