Open the settings of almost any VPN app and you will find a menu called protocol, listing options like WireGuard, OpenVPN, and IKEv2. Most people never touch it, and most of the time that is the right call. But the protocol decides how fast your connection runs, how much battery it uses, how quickly it recovers when you walk out of Wi-Fi range, and whether it connects at all on a locked-down hotel or office network. Knowing what the names mean turns that menu from alphabet soup into a practical tool.
A VPN protocol is the set of rules your device and the VPN server follow to build the encrypted tunnel between them: how they prove they are talking to the right machine, how they agree on encryption keys, and how they package your traffic for the trip. Different protocols make different trade-offs between speed, reliability, and compatibility, which is why your app offers more than one.
This guide covers the protocols you will actually see in apps, what each one is good at, and the few situations where changing the setting genuinely helps. If you are still deciding whether you need a VPN in the first place, start with our beginner's guide to VPNs and come back when you hit the settings screen.
What a VPN protocol actually does
Every protocol has two jobs. The first is the handshake: your device and the server confirm each other's identity and agree on the secret keys they will use, so that nobody sitting between them can impersonate the server or read what follows. The second is transport: wrapping each piece of your traffic in a layer of encryption and carrying it across the internet to the server, which unwraps it and sends it on its way.
Here is the reassuring part. Every modern protocol in this guide uses encryption that is considered strong, such as AES-256 or ChaCha20, and none of them has a known practical break. Choosing between the current options is not a security decision. The differences you will actually notice are speed, battery drain, how fast the tunnel rebuilds when your connection drops, and how easily a restrictive network can block it.
WireGuard: the modern default
WireGuard is the newest of the mainstream protocols and the one most apps now push to the top of the menu. It was designed from a blank page with one modern encryption suite instead of a long list of legacy options, and its code is short enough that a security specialist can read all of it. Less code means fewer places for bugs to hide, and its design has held up well under public review.
In everyday use, WireGuard is the fast one. Connections come up almost instantly, downloads and video calls feel close to your normal speed, and it is gentle on phone batteries because it stays quiet when no traffic is flowing.
One design quirk is worth knowing. Plain WireGuard expects the server to keep a table matching each user to an internal address, which in a naive setup could linger in memory. Reputable VPN services address this with systems that assign addresses dynamically or clear them on a schedule. It is a fair question for a provider's FAQ, not a reason to avoid the protocol.
When to pick it: almost always. If your app offers WireGuard and it connects reliably on the networks you use, there is rarely a reason to choose anything else.
OpenVPN: the proven workhorse
OpenVPN has been the standard for most of the time consumer VPNs have existed. It is open source, it has been audited repeatedly, and it runs on practically everything, from phones to home routers. It is slower than WireGuard and harder on batteries, but it earns its place in the menu with one specific strength: it is very hard to block.
OpenVPN comes in two flavors, and many apps let you choose between them:
- OpenVPN UDP sends traffic the fast, lightweight way. It is the default flavor and the right choice when nothing is interfering with your connection.
- OpenVPN TCP sends traffic the careful, confirm-every-step way. It is slower, but it can run on TCP port 443, the same port ordinary secure websites use. To a restrictive network, that traffic looks like someone browsing the web, which is exactly why it slips through when other protocols are blocked.
When to pick it: whenever WireGuard will not connect. Hotel networks, school networks, office guest Wi-Fi, and some countries filter VPN traffic aggressively, and OpenVPN TCP is the classic way around that. Think of it as the four-wheel-drive setting: slower on the highway, unstoppable in the mud.
IKEv2/IPsec: built for phones
IKEv2/IPsec is a pair of standards that work together: IKEv2 handles the handshake and IPsec carries the encrypted traffic. Its standout feature is a mechanism called MOBIKE, which lets the tunnel follow your device from one network to another without starting over. Walk out your front door and your phone hops from home Wi-Fi to cellular, and an IKEv2 tunnel comes along for the ride with barely a pause.
Because support is built into iPhones and many other devices at the system level, IKEv2 is also what you often get when you configure a VPN manually in your phone's settings. It is fast, stable, and secure.
Its weakness is the mirror image of OpenVPN's strength: IKEv2 uses distinctive ports that network administrators can block with one rule, so it sometimes fails on the same restrictive networks where OpenVPN TCP succeeds.
When to pick it: on a phone, especially if you move between Wi-Fi and cellular all day and notice your VPN dropping during the switch. If WireGuard already handles that well for you, there is no need to change.
The old protocols you can skip
A few names still appear in router settings pages and older apps. They are worth recognizing so you can avoid them.
- PPTP is broken. Its encryption can be cracked with ordinary hardware, so a PPTP tunnel gives you the feeling of privacy without the substance. If anything you own still uses it, treat that connection as unprotected.
- L2TP/IPsec is not broken, but it is slow, it struggles with home routers and firewalls, and it does nothing that IKEv2 does not do better. There is no reason to choose it today.
- SSTP is an aging Windows protocol that had a moment because it could sneak through firewalls. OpenVPN TCP does the same job and is open source, so SSTP has quietly faded.
The practical rule: if a device or service only offers these, that is a sign the product itself is out of date. A router that tops out at PPTP is due for replacement, not configuration.
Proprietary protocols and the automatic setting
Many VPN apps list a protocol with a brand-specific name you will not find anywhere else. These are almost always WireGuard or OpenVPN under the hood, modified by the provider for speed or to fix the address-table quirk described above. They are generally fine to use, and often they are the best-performing option in that particular app, since the provider tuned them for its own servers.
Two related settings deserve a mention:
- Automatic lets the app test conditions and pick a protocol for you, usually trying the fast option first and falling back to the blockable-network option if it fails. For most people this is the ideal setting: you get WireGuard speeds at home and OpenVPN persistence at the hotel without touching anything.
- Stealth or obfuscated modes wrap VPN traffic in an extra disguise so it looks like ordinary web browsing. These exist for networks and countries that actively hunt for VPN connections. They cost speed, so leave them off unless you need them.
Which protocol should you choose?
Match the situation to the setting and you are done.
- Everyday browsing at home: WireGuard, or your app's automatic setting.
- Streaming or large downloads: WireGuard, for the speed.
- Coffee shop, airport, or hotel Wi-Fi: automatic first; if the VPN will not connect, switch to OpenVPN TCP. Public networks are the moment a VPN earns its keep, and our guide to public Wi-Fi risks explains why.
- A phone that hops between networks all day: WireGuard or IKEv2, whichever reconnects faster for you.
- A network that seems to block VPNs entirely: OpenVPN TCP, or your app's stealth mode.
- Anything offering only PPTP or L2TP: decline, and update the device instead.
Notice what is not on this list: security. Among the modern options, the protocol menu is about comfort and compatibility, not safety. The security decisions that matter are picking a trustworthy provider and locking down the account itself with a strong, unique password and two-factor authentication.
A five-minute settings check
You can put all of this into practice right now.
- Open your VPN app, find the protocol menu under settings or preferences, and set it to WireGuard or automatic.
- While you are there, turn on the kill switch if your app has one. It blocks traffic whenever the tunnel drops, so your real address never leaks in the gap before it reconnects.
- Connect, then confirm the tunnel is working with our free IP checker. It should show the VPN server's location, not your own.
- Make a note that OpenVPN TCP is your fallback. The next time a hotel network refuses to cooperate, you will know exactly which switch to flip.
- Check your phone and router for old manual VPN profiles using PPTP or L2TP, and delete any you find.
