--- title: "Is WireGuard secure? What the research says, and what it can't promise" description: "Is WireGuard secure? One fixed set of modern cryptography, formal proofs and very little code, then the honest limits: keys, servers, bugs and visibility." section: "Guides" group: "How the technology works" source: https://wrapvpn.com/en/guides/is-wireguard-secure last_reviewed: 2026-11-03 --- # Is WireGuard secure? What the research says, and what it can't promise You're on café Wi-Fi with a bill to pay, your VPN says it runs on WireGuard, and you'd like to know whether that word deserves your bank login. Here's what the research says, and the few things no protocol can promise. TL;DR: Yes, WireGuard is one of the most closely examined ways to build a VPN tunnel. It uses one fixed set of modern cryptography with nothing to downgrade, several research teams have formally analysed its design, and its code is small enough to read in full. Its promises end where the tunnel ends, though, so the device holding your key and whoever runs the server matter as much as the protocol. ## The café, the bank and the question you're really asking Picture the corner table. You're on the café's guest Wi-Fi, you need to pay a bill from your bank's app, and you've switched your VPN on first, as you've been told to. Somewhere in its settings is the word WireGuard. Your banking app already encrypts its own traffic with HTTPS, so the VPN isn't the only thing standing between you and the café. What it adds is a second wall around everything your phone sends, so the café's network can't even tell that you're talking to a bank. The question is whether that second wall is well built. "Is it secure?" always means secure against whom, doing what. On café Wi-Fi, the realistic worries are someone reading your traffic, changing it, replaying it, pretending to be the VPN server, or quietly steering your phone towards weaker encryption. Let's take the evidence first, then the fair criticisms, and come back to the corner table at the end. ## Nothing to downgrade, because there's nothing to choose Many older protocols open with a negotiation. Each side lists the encryption methods it supports, and they settle on one they both know. It sounds sensible, and it has a long, unhappy history: an attacker who can interfere with that conversation can sometimes talk both sides down to the weakest option on the list. WireGuard's author points to the steady stream of SSL and TLS vulnerabilities as proof that this kind of flexibility adds enormous complexity. WireGuard has no negotiation at all. Every WireGuard device uses the same recipe, so there's no weaker item for anyone on the café's network to steer your phone towards. The recipe even has a name, and that name is mixed into the very first step of every handshake: *The name of WireGuard's handshake* ``` Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s ``` - Noise: a framework for building handshakes from well-understood parts, designed by the cryptographer Trevor Perrin. - IK: the shape of the handshake. Your phone already knows the server's public key, and sends its own identity in the first message, sealed so that only the server can read it. - psk2: room for an optional preshared key, an extra shared secret that two peers can mix in. - 25519: Curve25519, the mathematics both sides use to agree on a secret without ever sending it. - ChaChaPoly: ChaCha20 to scramble each packet, and Poly1305 to seal it against tampering. - BLAKE2s: a fast hash function, used to stir the keys together. ## Proved on paper, small enough to read, reviewed in public A fixed recipe only helps if the recipe is sound, and this is where WireGuard is unusually well documented. Its handshake has been formally analysed, which means researchers wrote the protocol down as precise mathematics and proved what it guarantees, rather than testing it and hoping for the best. Several teams have done this separately. One modelled the handshake in an automated proof tool called Tamarin and checked properties such as key secrecy, forward secrecy and resistance to impersonation. Others produced the kind of proof that ties a protocol's security to the strength of its building blocks, including one worked through with a tool called CryptoVerif. Then there's size. WireGuard's whitepaper puts its Linux version at under 4,000 lines of code, not counting the cryptographic building blocks, which is small enough for one reviewer to read from start to finish, and actually finish. After several years of public development and scrutiny, it was merged into the Linux kernel itself, arriving with Linux 5.6 in March 2020. None of that makes WireGuard perfect. It does mean the people whose job is to find holes have had years to look, with the whole design in front of them. ## Back at the corner table: what the café's network can and can't do Now put the evidence to work. Suppose whoever runs the café's Wi-Fi is up to no good, or someone at the next table has set up a fake network with the same name as the real one. Either way, they're in the perfect spot to interfere with everything your phone sends. Here's how each thing they might try goes: - Read your traffic: no. Every packet is encrypted with session keys that never crossed the network. - Change something on the way: no. The Poly1305 seal no longer matches, and the packet is dropped before it's opened. - Replay a recorded packet: no. Each one carries a counter, and the receiver refuses any number it has already seen. - Pose as the VPN server: no. Your phone only completes a handshake with whoever holds the server's private key, and a fake network doesn't have it. - Record everything and unlock it later with a stolen key: no. The one-off keys behind each session are thrown away, so a long-term key stolen tomorrow doesn't open today's recording. - Block the tunnel, or notice that it's WireGuard: yes. They can drop your packets, and WireGuard's messages have a recognisable shape. > **Note:** Blocking is a nuisance rather than a breach. It stops the tunnel working, but it reveals nothing about what would have travelled inside it. ## The fair criticisms, taken one at a time WireGuard has critics, and some of their points are simply true. Here they are, with what we think each one means for you. "It can't switch ciphers." Correct, and deliberate. The whitepaper says plainly that if a hole is ever found in one of the building blocks, every device will have to update. That's a bigger job than flipping a setting, but it trades a weak option lingering on a menu for one coordinated move to a new version, and we think that's the better deal. "It's only as safe as the private key." Also true. A device's private key is its whole identity, so malware that can read it can pose as that device, and no VPN can protect a phone that's already compromised. The server's key matters too: someone who recorded your handshakes and later stole it still couldn't read your data, but could work out which devices had been connecting. "It isn't quantum-proof." Not by default. A large enough quantum computer could break Curve25519, though nobody has built one. WireGuard's optional preshared key exists for exactly this worry: it mixes in a symmetric secret that quantum computers aren't expected to crack, provided that secret was shared safely in the first place. "Anyone can tell it's WireGuard." Yes. WireGuard makes no attempt to disguise itself, and its authors say that job belongs in a separate layer on top. On café Wi-Fi that's harmless. On a network that blocks VPNs, it's why WireGuard can be stopped. ## Where the protocol's promises stop Every guarantee so far covers the tunnel, from your phone to the VPN server. At the server, WireGuard's job is done: the server unseals your traffic and sends it on to your bank. Whoever runs that server is someone you're trusting, and what they keep about you is a matter of their policy, not of the protocol. This is where your bank's HTTPS earns its keep a second time. It protects your login and your balance from the VPN server just as it protects them from the café, which is why the two layers together are stronger than either one alone. Then there's the code. The proofs cover the design, not every line of every program that follows it. WireGuard exists as several separate implementations, including the one inside the Linux kernel and a portable version written in Go, and any of them could contain a bug, as any software can. Small, open, widely used code is the best defence against that, but it's a defence, not a guarantee. ## So, can you pay that bill? Yes. At the corner table, WireGuard is about as well built as a tunnel gets: the café can block it, but it can't read it, change it, replay it or impersonate the server, and your bank's own encryption still sits inside it. The questions left over are the ones no protocol answers. Is your phone up to date and free of anything nasty? And do you trust whoever runs the server? With WrapVPN, that second question is about us. We use WireGuard's standard handshake and cryptography, the ones described here, not a homemade variant, and our apps are built on open-source WireGuard code. On networks that block WireGuard, our Android and Windows apps can also disguise its packets, which changes how they look but not the cryptography inside. You never handle a key, because the app and our servers put them in place, so part of trusting the tunnel is trusting us with that, and our privacy policy sets out what we keep. To see how it feels in practice, install WrapVPN and try it on the free plan. ## Questions ### Is WireGuard more secure than OpenVPN? Both can be run securely. WireGuard's advantage is that there's less to get wrong: one fixed set of cryptography instead of a menu of options, and far less code to review. OpenVPN is mature and well studied too, but its flexibility leaves more room for a weak setup. ### Is WireGuard safe for online banking? Yes. On public Wi-Fi it hides your traffic from the network around you, including the fact that you're visiting your bank, and your bank's own HTTPS encryption still protects your login inside the tunnel. The bigger risks are a compromised phone or a VPN operator you have no reason to trust. ### Can WireGuard be hacked? The realistic routes in don't go through its cryptography. They're a stolen private key, malware on the device, a bug in one particular implementation, or a server run by someone you shouldn't trust. That's true of every VPN protocol, and WireGuard's small size makes the bug risk easier to manage. ### Does WireGuard use AES? No. It uses ChaCha20 for encryption and Poly1305 to detect tampering, a pairing chosen partly because it's fast in ordinary software, even on devices without special AES hardware. AES and ChaCha20 are both considered strong; WireGuard simply picked one so that nobody has to choose. ### Can my internet provider see that I'm using WireGuard? Usually, yes. It can tell that your device is sending WireGuard traffic to a particular server, because WireGuard doesn't disguise its messages. It can't see what's inside them, which websites you're reaching or anything you type. --- Source: https://wrapvpn.com/en/guides/is-wireguard-secure Last reviewed: 2026-11-03