What is WireGuard?

By John Nader · Updated 2026-06-27

WireGuard is a VPN protocol — the set of rules two computers use to build an encrypted tunnel between them. It was written by Jason Donenfeld, merged into the Linux kernel in 2020, and has since become the default choice for new VPNs because it is dramatically simpler and faster than what came before.

Why WireGuard exists

The older protocols — OpenVPN and IPsec — work, but they are large. OpenVPN is hundreds of thousands of lines of code; that is a lot of surface area for bugs and a lot to audit. WireGuard is about 4,000 lines. Small enough that a single person can read the whole thing, which is exactly why security researchers trust it more.

How it works, briefly

WireGuard uses modern, fixed cryptography (Curve25519 for key exchange, ChaCha20-Poly1305 for encryption). Each side has a key pair. You exchange public keys; the private keys never move. Once each peer knows the other's public key and endpoint, the tunnel comes up almost instantly and stays up with near-zero overhead. There is no negotiation dance like older protocols — the configuration is static and tiny.

Why we built vpn.golf on it

Two reasons that matter for your privacy. First, speed: WireGuard's low overhead means you barely feel the tunnel, so people actually leave it on. Second, and more important — the key model lets us generate your private key on your device. It never reaches our servers. We only ever store your public key to register you on an exit node. A VPN that never holds your private key simply cannot leak it.

The one trade-off to know

WireGuard assigns each device a stable tunnel IP, which is great for performance but means a naive setup could be more identifiable. Good operators handle this with dynamic address allocation and no connection logging. That's table stakes for us, not a feature.

Frequently asked questions

Yes. It uses modern, well-reviewed cryptography (Curve25519, ChaCha20-Poly1305) and its small codebase has been independently audited — far easier to verify than OpenVPN's much larger one.

In almost all real-world tests, yes — often substantially. Its low overhead is why it stays connected without draining battery or throttling your connection.

No. You pick a hole, download a config or use the app, and you're connected. This page is for the curious — the product hides the details.

WireGuard was written by Jason Donenfeld and released publicly in 2016. It was merged into the Linux kernel in 2020, which is a strong vote of confidence from the people who maintain that code.

Yes. WireGuard is open source and released under permissive licenses, so anyone can read, audit, and run it. vpn.golf builds on the same open implementation everyone else can inspect.

Roughly 4,000 lines, compared to hundreds of thousands for OpenVPN. A single reviewer can read the entire codebase, which is the main reason security researchers trust it.

It uses a fixed modern suite: Curve25519 for key exchange, ChaCha20-Poly1305 for authenticated encryption, and BLAKE2s for hashing. You can't accidentally configure it into a weak cipher.

Yes. There are official WireGuard apps for iOS and Android, and the protocol's fast reconnects and low overhead make it especially good on phones that switch between Wi-Fi and cellular.

WireGuard uses UDP only. That keeps it lean and fast, though it means restrictive networks that block unusual UDP traffic can sometimes interfere with it, unlike TCP-based protocols.

The static configuration is what makes WireGuard so fast and simple. The trade-off is that a naive setup could be more identifiable, so good operators use dynamic address allocation and keep no connection logs — which is what we do.

A properly configured WireGuard tunnel routes all your traffic through the encrypted link, so your real IP stays hidden. Use our What is my IP and DNS leak test tools after connecting to confirm everything is going through the tunnel.

Yes. With vpn.golf your private key is generated on your own device and never sent to us — we only store your public key to register you on an exit node. A VPN that never holds your private key cannot leak it.
Want to try it?

vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.

Step up to the tee — free