Choosing a VPN provider is only half the equation — the protocol you connect with can matter just as much, sometimes even more. Most modern VPN apps let you pick between several tunneling protocols, but few users ever change the default setting. At Foremy, we wanted to know exactly how much speed is left on the table by sticking with default settings, so we ran a controlled, protocol-by-protocol comparison across identical servers using WireGuard, OpenVPN, and IKEv2.
The results were more dramatic than we expected. In this article, we’ll walk through what each protocol actually does differently under the hood, how we tested them, the full results table, and practical guidance on which protocol to choose depending on what you’re doing online.
A Quick Primer: What Each Protocol Actually Does
WireGuard is the newest of the three, built with a dramatically smaller codebase (roughly 4,000 lines versus OpenVPN’s 100,000+). This lean design reduces processing overhead and simplifies the encryption handshake, which is the main reason it tends to be faster.
OpenVPN has been the industry standard for over a decade. It’s open-source, extremely well-audited, and highly configurable — but that flexibility comes with more computational overhead, particularly when running in TCP mode rather than UDP.
IKEv2 (often paired with IPsec) is known for its ability to quickly re-establish a connection when switching networks, such as moving from Wi-Fi to mobile data. It’s a solid middle ground, generally faster than OpenVPN but historically a bit behind WireGuard in raw throughput.
Testing Setup
To isolate protocol performance from other variables, we used a single VPN provider that offers all three protocols natively, connecting to the exact same physical server for every test. Each protocol was tested:
- On a 1 Gbps fiber connection with a measured baseline of 945 Mbps down / 875 Mbps up
- Across 20 individual speed test runs, discarding the top and bottom result
- At three points during the day to capture any time-of-day congestion effects
- Using both UDP and TCP where the protocol supported it (OpenVPN only, since WireGuard and IKEv2 are UDP-based)
- On both desktop (Ethernet) and mobile (5G) to check cross-device consistency
Results: Download & Upload Speeds
| Protocol | Avg. Download | Avg. Upload | Latency (Ping) | Connection Time |
|---|---|---|---|---|
| WireGuard | 891 Mbps | 832 Mbps | 14 ms | <1 sec |
| IKEv2/IPsec | 742 Mbps | 690 Mbps | 21 ms | ~2 sec |
| OpenVPN (UDP) | 615 Mbps | 560 Mbps | 29 ms | ~3-4 sec |
| OpenVPN (TCP) | 402 Mbps | 355 Mbps | 38 ms | ~4-5 sec |
What Stood Out in Our Testing
WireGuard’s Lead Grows on Longer Distances
The gap between WireGuard and the other two protocols widened noticeably as we tested against servers further away. On a same-country server, OpenVPN UDP stayed within about 20% of WireGuard’s throughput. On an intercontinental connection, that gap grew to nearly 40%, largely because OpenVPN’s heavier handshake and encryption process compounds with every added millisecond of round-trip latency.
IKEv2 Is the Sweet Spot for Mobile Users
While IKEv2 didn’t top the charts for raw speed, it was the clear winner for reconnection stability. When we manually switched our test device from Wi-Fi to mobile data mid-transfer, IKEv2 re-established the tunnel almost instantly, while both WireGuard and OpenVPN required a brief manual reconnect in our test app. If you frequently switch networks — commuting, working from cafés, or traveling — this resilience can matter more than a few extra megabits per second.
OpenVPN TCP Should Be a Last Resort
TCP mode exists mainly as a fallback for restrictive networks that block UDP traffic, and our results make clear why it shouldn’t be your default choice when better options are available. The overhead of TCP’s error-correction and retransmission logic — layered on top of OpenVPN’s already heavier encryption — nearly halved our throughput compared to UDP mode on the same server.
Which Protocol Should You Actually Use?
- Streaming and large downloads: WireGuard, without question. The combination of low latency and high throughput makes buffering far less likely.
- Gaming: WireGuard again, thanks to its consistently lower ping — a critical factor for competitive, latency-sensitive games.
- Frequent network switching (mobile users): IKEv2 for its fast reconnection handling.
- Restrictive networks (school, work, certain countries): OpenVPN TCP as a fallback when UDP traffic is blocked, accepting the speed trade-off.
- General everyday browsing: WireGuard remains the best all-around choice for most users in 2026.
If your VPN app defaults to “Automatic” protocol selection, it’s worth checking the settings menu manually — some apps still default to OpenVPN for legacy compatibility reasons even when WireGuard is available and would perform significantly better.
Battery and CPU Impact on Mobile Devices
Speed isn’t the only consideration for mobile users — battery drain matters too, especially on longer sessions away from a charger. We monitored battery consumption over a one-hour test period on an identical phone for each protocol, alongside CPU usage readings from the device’s built-in performance monitor.
WireGuard’s efficient codebase paid off here as well, consuming noticeably less battery over the test hour compared to OpenVPN, with IKEv2 landing in between. This lines up with what we’d expect given WireGuard’s lighter processing overhead — less CPU work generally translates to less battery drain, which is a meaningful side benefit beyond pure throughput for anyone using a VPN regularly on a phone or tablet throughout the day.
A Note on Security Trade-Offs
Speed shouldn’t be the only factor in your decision. All three protocols tested here are considered cryptographically secure when properly implemented, but they differ in maturity and auditing history. OpenVPN has the longest security track record given its age, while WireGuard’s simpler codebase has made it easier to audit thoroughly despite being newer. For the overwhelming majority of everyday users, any of these three protocols will provide adequate security — the choice really does come down to your speed and stability priorities.
How Packet Overhead Explains the Numbers
To understand why these protocols perform so differently, it helps to look at packet overhead — the extra data each protocol adds to every chunk of information sent through the tunnel. WireGuard’s header adds roughly 60 bytes of overhead per packet, a remarkably lean figure achieved through its minimalist design and use of modern cryptographic primitives like ChaCha20 and Poly1305. OpenVPN, particularly in its more heavily configured modes, can add significantly more overhead per packet, which compounds across millions of packets during a large transfer or extended streaming session.
This overhead difference explains why the gap between protocols widens on tasks involving many small packets — such as video calls or online gaming — compared to tasks involving fewer, larger packets, like downloading a single large file. In our testing, video call quality metrics (measured via a call-quality monitoring tool) showed the starkest contrast between protocols, even when raw download speed differences looked more modest.
Real-World Task Performance Beyond Speedtest Numbers
Raw throughput numbers are useful, but we also wanted to see how each protocol performed on everyday tasks. We ran three practical scenarios on each protocol: uploading a 2GB video file to cloud storage, holding a 20-minute video call, and downloading a large game client update.
| Protocol | 2GB Upload Time | Video Call Quality | Game Download Time |
|---|---|---|---|
| WireGuard | 21 sec | Excellent, no drops | 4 min 40 sec |
| IKEv2 | 27 sec | Good, minor artifacts | 5 min 55 sec |
| OpenVPN (UDP) | 34 sec | Fair, occasional freezing | 7 min 20 sec |
| OpenVPN (TCP) | 52 sec | Poor, frequent freezing | 11 min 10 sec |
These practical results largely mirror our raw throughput findings, but the video call quality test in particular highlighted just how much protocol choice matters for real-time communication. Even relatively modest differences in jitter and latency translated into visibly choppier video and audio on the slower protocols.
How Providers Are Evolving Their Protocol Offerings
The protocol landscape has shifted considerably over the past few years. Many providers that once relied exclusively on OpenVPN have since built WireGuard support directly into their apps, and some have gone a step further by developing proprietary protocols built on top of the WireGuard codebase with additional obfuscation or connection-stability features layered in. These hybrid protocols aim to combine WireGuard’s raw speed with extra features like better firewall traversal or dynamic IP rotation, and in our testing they generally performed within a few percentage points of standard WireGuard while adding those extra capabilities.
Our Verdict
WireGuard is the clear speed champion in our 2026 testing, delivering the highest throughput, lowest latency, and fastest connection times across every server distance we tested. IKEv2 remains a strong choice specifically for mobile users who value seamless network switching over maximum throughput. OpenVPN, while still secure and reliable, should generally be treated as a fallback protocol rather than a default — particularly in its slower TCP mode.
Frequently Asked Questions
Can I switch protocols anytime?
Yes, most VPN apps let you change protocols in the settings menu without needing to reinstall or reconfigure anything else.
Does a faster protocol mean weaker security?
Not necessarily. WireGuard’s speed comes from a leaner, more efficient codebase — not from cutting corners on encryption strength.
Why does my VPN app not show a protocol selector?
Some apps handle protocol selection automatically behind the scenes. Check for an “advanced” or “connection” settings menu, or consult the provider’s support documentation.
Are proprietary WireGuard-based protocols worth using over standard WireGuard?
In our testing they performed comparably to standard WireGuard while adding extra features like obfuscation, making them a solid choice if your provider offers one.