Why WrapVPN is built on WireGuard

Picture a phone on an ordinary weekday. It connects at home on Wi-Fi, loses that Wi-Fi at the front door, rides the train on patchy mobile data and joins the office Wi-Fi an hour later.

A tunnel protocol for that phone has to encrypt everything, connect without a long wait, survive every change of network, and stay out of the way the rest of the time. It also has to be something that we, and people who don't work for us, can check.

Older VPN protocols can do much of this, but they were designed in an era of desks and office networks, and they carry a lot of history. WireGuard is far more recent, and it was designed with moving devices in mind.

WireGuard is tiny by VPN standards. Its original Linux implementation is around 4,000 lines of code, while older VPN software runs to hundreds of thousands once the libraries it depends on are counted. That difference matters more than it sounds.

Security problems hide in code nobody has read closely. A protocol small enough for one expert to review from start to finish is one that many experts actually have reviewed, and WireGuard has had that attention: researchers have analysed its design formally, and it has been part of the Linux kernel since 2020.

Small also means less to configure. There's no long list of options for us to set and for you to wonder about, and fewer settings leave fewer ways for a VPN to be set up wrongly.

Many older protocols let the two ends negotiate which encryption to use from a long list of options. That flexibility has a cost. A list with weak options on it can, in the wrong conditions, be talked down to one of them, and choosing safely takes expertise most people don't have.

WireGuard has no list. It uses one fixed set of modern, well-studied algorithms, the same on every device, so there's nothing to negotiate and nothing to downgrade. Your phone and the exit server have agreed on how to encrypt before they ever meet.

The trade-off is deliberate. If one of those algorithms ever needs replacing, WireGuard moves to a new set as a whole rather than adding another option to a menu. We think that's the right way round: one good choice, changed carefully, beats twenty choices left to chance.

Back to the weekday phone. When it connects at home, WireGuard's handshake is a single round trip: one message from the phone and one reply from the exit server, each proving it holds the key the other expects. There's no negotiation to sit through, so the tunnel is ready almost as soon as the reply arrives.

At the front door, the phone drops the Wi-Fi and picks up mobile data, with a new address on a different network. WireGuard doesn't mind. It knows your device by its key, not by its address, so when the next packet arrives from somewhere new, the exit server checks the key and sends its replies there instead. The same thing happens on the train, and again at the office.

To the websites on the other end, nothing has moved at all. They were talking to the exit server before the phone left the house, and they're still talking to the same exit server on the train. For a phone that changes networks several times before lunch, that calm is worth more than any benchmark.

WireGuard is deliberately just the tunnel. It has no idea who you are, whether you've paid, which locations exist or how a new phone should be set up. It assumes each device has already been told the server's key and address, and that each server already knows which device keys to accept. Something else has to arrange all of that.

That something is us. You sign in with Apple or Google, so WrapVPN has no passwords of its own. When you tap Connect, our server checks that your account can connect, tells the exit server for your chosen location to expect your device's key, and hands your app a configuration for that location. We also run the exit servers, and we added Clean Web, our ad and tracker blocker, on top of the tunnel.

That's where WireGuard's guarantees stop. A well-made lock tells you nothing about who holds the keys, and WireGuard's strengths don't cover how well a VPN service is run: who it lets connect, how it looks after its servers, or what it keeps. Those are ours to answer for, and our privacy policy sets out what we keep.

We chose WireGuard because it's small enough to check, strong without settings, quick to connect and unbothered by a moving phone. The parts it leaves out are the parts we build and run, and the easiest way to judge the result is to install WrapVPN and leave it connected on your next commute.