What Is WireGuard? The Modern VPN Protocol Explained Simply
Every VPN needs a protocol — the set of rules that defines how your device and the VPN server build an encrypted tunnel. For two decades that meant OpenVPN or IPsec: reliable, but heavy and complex. WireGuard changed that.
What is WireGuard?
WireGuard is an open-source VPN protocol designed from scratch for speed, simplicity, and modern cryptography. It was created by security researcher Jason A. Donenfeld and has been part of the Linux kernel since 2020 — a strong signal of how thoroughly its code has been reviewed.
The numbers tell the story: WireGuard's core is roughly 4,000 lines of code. OpenVPN and IPsec stacks run into the hundreds of thousands. Less code means fewer places for bugs and vulnerabilities to hide, and far easier auditing.
Why WireGuard is fast
- Runs in the kernel. Traffic doesn't bounce between kernel and user space the way it does with OpenVPN, so there's less overhead per packet.
- Modern cryptography only. WireGuard uses a fixed, opinionated set of primitives — ChaCha20 for encryption, Poly1305 for authentication, Curve25519 for key exchange. No negotiating outdated ciphers, no downgrade attacks.
- Instant handshakes. Connections establish in a fraction of a second, and reconnects after network changes (Wi-Fi to cellular, for example) are nearly seamless.
In practice this means faster downloads, lower latency, and noticeably better battery life on phones compared to older protocols.
How a WireGuard connection works
- Your device and the server each hold a key pair — similar to SSH keys.
- When you connect, they perform a quick handshake and derive fresh encryption keys.
- All traffic then travels through the encrypted tunnel as UDP packets.
- Keys are automatically rotated in the background, providing forward secrecy.
There are no usernames or passwords at the protocol level — only cryptographic keys. If a config file doesn't contain the right private key, the server simply doesn't respond.
How nuVPN uses WireGuard
All nuVPN apps — Windows, macOS, iOS, Android, and Linux — are built on WireGuard. When your private server is provisioned, it's configured with WireGuard, and your .nuvpn configuration file is a standard WireGuard config: open, inspectable, no proprietary lock-in.
Combined with a server that's yours alone, you get modern-protocol speed without sharing bandwidth — or an IP address — with anyone else.
The bottom line
WireGuard took everything the VPN industry learned in twenty years and rebuilt it lean: less code, stronger cryptography, dramatically better performance. That's why it has become the default choice for modern VPN services — and why nuVPN is built on it.