Quick answer
WireGuard is a VPN protocol designed from scratch around modern cryptography and a very small codebase, roughly four thousand lines compared with hundreds of thousands for older protocols. That makes it fast, light on battery, quick to reconnect when you switch networks, and far easier to audit. SecureNet uses WireGuard exclusively: there is no protocol menu because there is no better option to offer.
Key facts
- About 4,000 lines of code, against several hundred thousand for OpenVPN's stack. Less code, fewer places for bugs.
- Fixed modern cryptography (ChaCha20, Poly1305, Curve25519, BLAKE2s). No negotiation, no weak options.
- Connects in about a second and survives switching from Wi-Fi to cellular without dropping.
- Lower battery use than OpenVPN because it does less work per packet.
- Built into the Linux kernel since 2020 and used by most major VPN services today.
What a protocol does
A VPN protocol is the set of rules for building the encrypted tunnel: how the two ends prove who they are, how they agree on keys, and how each packet is wrapped. Every VPN uses one. For most of the 2010s the choice was between OpenVPN, which is flexible and slow, and IKEv2/IPsec, which is faster but complex and unevenly implemented. Our introduction to VPNs covers the tunnel itself; this is about what the tunnel is made of.
What WireGuard did differently
WireGuard was designed by Jason Donenfeld with one governing idea: make it small. Rather than supporting every cipher and every option, it fixes a single set of modern cryptographic primitives and removes negotiation entirely. The result is a protocol that fits in a few thousand lines and can be read by one person in an afternoon.
- No cipher negotiation. Both ends already know exactly which algorithms to use, so there is nothing to downgrade and nothing to misconfigure.
- Stateless handshake. A connection is established in one round trip, which is why it feels instant.
- Roaming built in. If your IP address changes because you walked from Wi-Fi onto cellular, the tunnel simply continues from the new address.
- Silence by default. A WireGuard server does not respond to packets that are not from a known key, so it is invisible to scanning.
WireGuard, OpenVPN and IKEv2 compared
| WireGuard | OpenVPN | IKEv2/IPsec | |
|---|---|---|---|
| Codebase | Very small | Very large | Large, spread across the OS |
| Cryptography | Fixed, modern | Configurable, includes legacy options | Configurable |
| Connection time | About a second | Several seconds | One to a few seconds |
| Handles network changes | Seamlessly | Usually reconnects | Well |
| Battery impact on iPhone | Low | Higher | Moderate |
| Ease of audit | High | Low | Low |
What this means on an iPhone
Phones change networks constantly and spend most of their time asleep. A protocol that needs a long renegotiation every time the network changes will feel broken on a phone, and one that does heavy work per packet will show up in battery statistics. WireGuard's roaming and lightweight design are why SecureNet can reconnect the moment you leave the house without you noticing, and why leaving it on all day is not a battery decision.
Why SecureNet offers only WireGuard
Some VPN apps present a protocol menu. We considered it and decided against it. Every extra protocol is more code to maintain, more surface for bugs, and a choice most people are not equipped to make. WireGuard is faster, simpler and more auditable than the alternatives, and there is no situation on iPhone, iPad or Mac where we would recommend switching away from it. So there is no switch.
Less to configure is not a limitation. It is the whole design philosophy of the protocol, and we kept it in the app.
Speed in practice
The protocol removes most of the encryption overhead, which leaves distance and server load as the things that determine your speed. That is why SecureNet's Automatic mode picks servers by latency and load, and why the app includes a speed test in Settings. More on that in Does a VPN slow down your internet?
Frequently asked questions
Is WireGuard secure?
Yes. It uses current, well-regarded cryptography, has been formally analysed, and its small codebase has been audited far more thoroughly than older protocols could be.
Is WireGuard faster than OpenVPN?
Consistently. It does less work per packet and connects in a single round trip. On the same server, WireGuard typically delivers higher throughput and lower latency.
Can I switch SecureNet to another protocol?
No. SecureNet uses WireGuard exclusively. There is no protocol setting because there is no better option to offer on iPhone, iPad or Mac.
Does WireGuard work when I move between Wi-Fi and cellular?
Yes, that is one of its design goals. The tunnel continues from the new address without a full reconnect.