Why WrapVPN connects so quickly

Rather than time anything, let's count. You're at home with your phone on Wi-Fi, London is selected, and you tap Connect. Here is what happens next, in order.

Notice how short that list is. Making a connection is mostly waiting for messages to cross the network, so the fewer exchanges a VPN needs, the sooner it's ready. WrapVPN needs two, and only the second is between your device and the exit server.

That second exchange is the WireGuard handshake, and it works a bit like a hotel key card. By the time you reach the door, the exit server has already been told which key to expect, so there's no conversation at reception. Your device sends one message that only the holder of its private key could have produced, carrying what's needed to make fresh session keys. The exit server checks it and sends one reply proving its own identity, and both sides now share keys that nobody else has.

A door that opens only for the right key card has a pleasant side effect, too. WireGuard doesn't answer messages that aren't signed with a key it expects, so the exit server gives strangers nothing to talk to, and nobody can keep it busy with a long negotiation.

One message out, one back, and the tunnel is ready; your device can send real traffic as soon as the reply arrives. While you stay connected, WireGuard regularly replaces those session keys in the background, without pausing your traffic or asking you anything.

Many older VPN protocols were designed to work with almost anything, so before your traffic can flow, the two ends hold a short meeting. Which encryption shall we use? Here's my certificate, and here's mine. Let's agree the keys, then the settings for the tunnel. Every item on that agenda is another message crossing the network and another wait for the answer.

On a fast local network the meeting is over quickly. On hotel Wi-Fi or with a faraway server, every extra round trip is felt. WireGuard skips the meeting: both sides already use the same fixed encryption, and the exit server was told to expect your key a moment earlier, so all that's left is to prove who's who.

Now you walk out of the front door. Your phone loses the home Wi-Fi and switches to mobile data, which gives it a new address on a completely different network.

Plenty of connections would have to start again at this point. WireGuard doesn't, because it never identified you by your address in the first place. The exit server knows your device by its key, so when the next correctly signed packet turns up from the mobile network, it accepts it and sends its replies to the new address. There's no new request to our server and nothing to set up again.

Your device also keeps the same address inside the tunnel throughout, and websites keep seeing the same exit server, so to everything on the far side of the tunnel the switch is invisible.

Your phone may take a moment to change networks, as it would without a VPN, but the tunnel doesn't add a reconnection on top of that.

Every round trip is a physical journey. Light in an optical fibre covers about 100 km for each millisecond of a round trip, and real cables never run in perfectly straight lines, so distance sets a floor that no protocol can get under.

From London, Frankfurt is roughly 640 km away, which puts that floor at about 6 milliseconds per round trip. Sydney is about 17,000 km away, which puts it at 170 milliseconds or more, around a sixth of a second, before any other delay. Real routes add to both, but the faraway server always starts far behind. The handshake feels that distance once, and every page you load afterwards feels it again.

So pick a location near you unless you need websites to see you somewhere else. On phones, tablets and Windows PCs, each location in the app shows a speed figure, and a lower figure is faster; on any device, the nearest location is usually the quickest.

Connecting quickly comes down to doing very little: one request to our server, one round trip with the exit server, and nothing to repeat when your phone changes networks. How fast pages load afterwards still depends on your network and the distance to your server, so choose a nearby location and try it on your next walk out of the door.