Does WireGuard drain your battery?

A phone spends its energy on three big things: the screen, the processor, and the radios that talk to Wi-Fi and the mobile network. While you're using the phone, the screen usually wins comfortably. The radios come next, and they have a habit worth knowing about.

A mobile radio doesn't power down the moment a packet has gone. It stays in a high-power state for several seconds in case more data follows, and only then drops back to a low-power wait. Researchers measuring 4G phones found that for small, scattered bursts of data, this lingering can cost more than the sending itself. Wi-Fi radios have the same habit, but a far smaller one.

So a VPN can cost you battery in four ways: waking the radio more often, keeping it busy for longer, the work of encrypting each packet, and the fuss of reconnecting when your phone changes network. We'll follow one ordinary day on one phone, with WrapVPN connected from breakfast to bedtime, and see where WireGuard spends.

Your phone sits on the kitchen table, connected over home Wi-Fi, while you make coffee. Nothing much is happening, and WireGuard matches it. It doesn't check in with the server, poll for news or send 'are you still there?' messages. In the words of its own documentation, it isn't a chatty protocol: when there's nothing to send, it sends nothing.

Even WireGuard's housekeeping waits for real traffic. Session keys, the short-lived keys that seal your packets, are replaced every couple of minutes while the tunnel is in use, but sending data is what triggers the replacement, so, by default, an idle tunnel isn't renewing keys in the background. Its check that the other side is still alive works the same way. If the server sends your phone something and your phone has nothing to say back within ten seconds, it replies with a tiny empty packet. When neither side is sending, the line stays silent.

That's the baseline: a connected WireGuard tunnel with nothing to carry costs close to nothing. Close to, not quite, and the difference is one packet it sends on purpose.

Home routers and mobile networks keep track of the connections passing through them, and they forget the ones that go quiet. Once that happens, the server can't reach your phone until your phone speaks first, so anything heading your way through the tunnel can be held up.

WireGuard's answer is an optional setting called PersistentKeepalive. Switch it on and the device sends a tiny sealed packet, with nothing inside, whenever the tunnel has been quiet for a set number of seconds. Any real traffic resets the clock, so a busy tunnel never sends one at all. WireGuard leaves it off by default, because it's only needed by a device behind a router or firewall that still wants to receive traffic, which, as it happens, describes almost every phone.

Every WrapVPN app keeps it switched on, so the tunnel stays reachable all day. The honest cost is that on mobile data even a packet this small can wake the radio and set off that high-power lingering. A keepalive also counts as sending, so on a quiet tunnel it sets off the key replacement every couple of minutes too, a brief exchange while the radio is awake anyway. On Wi-Fi the cost is tiny; on mobile data it's real but small, and it buys a tunnel that stays reachable instead of one that has to be woken up.

You walk out of the door, the home Wi-Fi fades and your phone switches to mobile data. Its address on the internet changes completely.

Older VPN protocols tend to treat that as a broken connection. They notice the silence, give up and set the tunnel up again from scratch, with a negotiation that takes several round trips. Each attempt keeps the radio busy, and on a commute with patchy signal it can happen again and again.

WireGuard skips the ceremony. The server knows your phone by its key rather than its address, so the next sealed packet from the new network is enough: the server checks it and starts replying there. In WrapVPN's phone apps, moving between Wi-Fi and mobile data doesn't stop the tunnel, and there's no reconnection for the radio to sit through. Our guide to what WireGuard is explains how that works in more detail.

At lunch you watch a few videos over the café's Wi-Fi. This is where the tunnel works hardest: every packet is encrypted on the way out, decrypted on the way in and checked for tampering, thousands of times a minute.

WireGuard uses ChaCha20 to scramble each packet and Poly1305 to seal it against tampering, a pairing chosen partly because it runs fast in ordinary software, with no special support built into the chip. WireGuard's whitepaper points out that this makes it the quickest option on processors without dedicated AES instructions, the hardware shortcut that the main alternative cipher, AES, relies on for its speed.

In fairness, most current phone chips do have those AES instructions, so on a new phone ChaCha20's head start largely disappears, and AES may even be the quicker of the two. The bigger point holds either way. On any recent phone, encrypting your traffic is a small job next to lighting the screen for a video and keeping the radio busy receiving it.

By the evening, you open the battery screen and the VPN app sits near the top with an alarming share. Here's what's probably going on.

With WrapVPN connected, all of your phone's traffic, IPv4 and IPv6 alike, travels through the tunnel. That makes the VPN app the one handing every packet to the radio: the videos at lunch, the photos that synced on the train, the maps on the way home. Battery screens, on iPhones in particular, can count that radio time against the app that carried the traffic rather than the app that asked for it. The video app's share shrinks, the VPN's grows, and the total stays much the same.

Developers who have tested this describe that pattern: in one test on an iPhone, hours of streaming video used about as much battery with the VPN on as with it off, while the battery screen credited about a third of it to the VPN. How much this happens varies with the phone and its software version, so treat it as a likely explanation rather than a rule.

The fair measure is the total. Compare how much battery an ordinary day uses with the VPN and without it, rather than reading the percentage beside one app's name.

One part of a VPN can save battery rather than spend it. Clean Web, WrapVPN's ad and tracker blocker, stops your phone looking up the addresses of known advertising and tracking domains, so those connections never start. No connection means nothing to download and no reason for the radio to wake up for it, which over a day of browsing adds up to less data and less radio time.

It works in every app that uses your phone's normal name lookups; a browser using its own secure DNS setting goes around it. It blocks by domain name and doesn't read pages. Clean Web is on by default on Android and off by default on iPhone and iPad, so it's worth checking the switch.

The other big lever has nothing to do with the VPN: signal. A phone clinging to one bar of mobile signal works its radio far harder for every byte than one sitting next to a router, VPN or no VPN. On a bad battery day, look there first.

A little. A WireGuard tunnel costs some extra radio time and a sliver of processing, and very little else: it's silent when idle apart from an occasional keepalive, it doesn't start over when you change networks, and its encryption is light work for a modern phone. The fairest test is your own: install WrapVPN, leave it connected through an ordinary day, and compare the day's total with one without it.