WireGuard and privacy: what a WireGuard server remembers about you

Let's follow a single evening. At seven you're on the sofa, on your home Wi-Fi, and you connect your phone to a WireGuard VPN server in London. At nine you walk round to a friend's, and your phone swaps Wi-Fi for mobile data on the way. You're home again by eleven, back on your own Wi-Fi, and at half past you tap Disconnect and go to bed.

Several parties were part of that evening: your phone, your broadband and mobile networks, the server in London, the company that runs it, and the websites you visited. By breakfast, each of them remembers something different.

Most of this piece is about the server, because that's where the criticism points. To see why it remembers what it does, start with what it holds while you're connected.

WireGuard knows devices by key, not by name or account. A server's configuration is a list of peers, WireGuard's word for the devices it will talk to, and while it runs it holds five things about each one:

Here's the part that surprises people: WireGuard has no goodbye. Its protocol has only four kinds of message, two for the handshake, one for coping with heavy load and one for data, and none of them means "I'm leaving". When you tap Disconnect, your phone simply stops sending.

The server tidies up what it can. When no fresh handshake arrives, it wipes the session keys from memory within minutes, so the keys that protected your evening are gone. The peer entry itself stays, though, and so does what it learned about you.

Run WireGuard's wg tool on that server at eight the next morning, and your entry would look something like this:

Read that entry the way the server does. The endpoint is your home broadband's address, because that's where your last genuine packet came from. The mobile network's address from nine o'clock has gone, overwritten the moment you got home. The handshake time shows roughly when you stopped, and "sent" is the big number because it counts what the server sent to you.

So WireGuard's memory is a whiteboard, not a diary. There's one line per device, and each change rubs out what was there before, so the server can't tell you where you were at nine. The catch is that nobody wipes the board when you leave. The line stays until someone removes your peer or the server's WireGuard interface restarts, and your inside address stays the same for as long as your peer is configured.

On a server you run for yourself, none of this matters: it's your machine, and the address on the board is your own. A VPN server shared by thousands of strangers is a different picture.

On a public VPN server, that whiteboard pairs each device's key, which the service can link to an account, with the home or mobile address it last connected from. Anyone able to read the server's memory, whether through a break-in, a seizure or a legal demand, could read those pairs. And because the inside address doesn't change, anything else the server notes against that address points back to the same device night after night.

None of this is a weakness in WireGuard's security, since nothing on the board says what you did. WireGuard was built, much like SSH, to connect machines that already know each other, not to hide one end from the other. Services that worry about the leftover state describe a few kinds of fix, usually in some combination:

Those fixes all deal with protocol state: what the software needs in memory to work at all. WireGuard can't send you a reply without your endpoint, so it has to hold one. A log is something else: a decision to write something down, usually with a time on it, and keep it.

The protocol neither requires logs nor prevents them. An operator could wipe WireGuard's table every few seconds and still record every connection somewhere else, while another could leave the table alone and keep very little beyond it.

So "does it use WireGuard?" tells you almost nothing about privacy. "What do you write down, and for how long?" tells you a great deal.

Here we owe you a straight answer. Our records go well beyond anything WireGuard needs, so a story about how promptly we tidy WireGuard's table would be beside the point.

We keep connection records, including your account, the time, the server and how long each session lasted. Our exit servers send us hourly usage summaries for each inside address, with the amount of data and the addresses and domain names reached, and because we know which account and device each inside address belongs to, those summaries can be linked to you. Sign-ins and the apps' requests to our servers are recorded with the IP address they came from. Our privacy policy lists each record and how long it's kept, and some have no automatic deletion.

So here's the morning after with WrapVPN. Your broadband and mobile networks saw encrypted packets travelling to our server, and nothing of what was inside them. The websites saw our exit server's address rather than yours. Over IPv4, everyone connected to that server shares it; where the server also offers IPv6, sites reached that way see an address set aside for your device. And we hold the records above, which say far more than one line on a whiteboard. If that's a trade you're comfortable with, the free plan is the easiest way to try WrapVPN for yourself.