A virtual private network (VPN) transmits data through an encrypted connection to a server. Other criteria are covered in the protocol selection guide.
Why WireGuard is often faster
A protocol's speed depends on encryption overhead and header size: the processor handles the data, while protocol overhead bytes take up part of the bandwidth. Extra wrappers and traffic obfuscation also consume resources.
WireGuard is simple in design: the ChaCha20 cipher is fast in software, and its implementation in the Linux kernel reduces packet processing overhead. However, the WireGuard developers themselves admit that their published benchmarks are outdated: they cannot be used as today's ranking.
The Advanced Encryption Standard (AES) is accelerated by the processor's AES-NI hardware instructions. On a modern computer, encryption often does not limit speed, but an older router may lack the processing power.
OpenVPN 2.6 has Data Channel Offload (DCO): it moves packet processing into the kernel and reduces load. It requires a compatible system and Authenticated Encryption with Associated Data (AEAD), which encrypts and verifies integrity. The conditions are described in the OpenVPN 2.6 manual, but you need to check whether it is available in your client.
How to compare WireGuard, OpenVPN and VLESS
The User Datagram Protocol (UDP) sends packets without its own retransmission mechanism. The Transmission Control Protocol (TCP) tracks delivery and retransmits lost data. WireGuard works only over UDP; for OpenVPN this transport is also preferable.
| Protocol | What helps speed | What to consider |
|---|---|---|
| WireGuard | Simple UDP exchange, ChaCha20, implementation in the Linux kernel | Clients and devices vary |
| OpenVPN UDP | UDP and DCO acceleration with compatible settings | DCO is not available in every configuration |
| VLESS | Lightweight proxy protocol with various transports | Speed depends on the transport and protective wrapper |
| Hysteria2 | Runs over QUIC with congestion control | The result depends on packet loss and connection settings |
VLESS is a proxy protocol; compare it together with its transport and protective wrapper. The transport of the "VLESS tcp" variant is now called RAW in the Xray documentation. Protection is usually provided by a separate layer: for example, Transport Layer Security (TLS) encrypts the connection.
Hysteria2 uses QUIC, a secure transport over UDP, and is designed in part for networks with packet loss. Its congestion control modes help adjust transmission to the line, but they do not guarantee speed-ups or circumvention of restrictions.
OpenVPN's TCP mode is usually less efficient on a congested network: waiting and retransmitting lost data can slow down the exchange. The details are covered in the UDP vs TCP comparison.
What to measure for video and calls
Data passes through a chain: device → Wi-Fi → ISP → VPN server → website. Server load, distance and Wi-Fi interference affect the result alongside the protocol. In the UK, start with the nearest British location: it is a starting point, with no guarantee of the best route.
Data passes through a chain
Server load, distance and Wi-Fi interference affect the result alongside the protocol.
| Metric | What it shows | Where it is especially useful |
|---|---|---|
| Throughput, Mbit/s | How much data passes per second | File downloads and video quality |
| Latency, ms | How long the round trip takes | Calls and gaming |
| Jitter | How much the latency varies | Smoothness of audio in conversation |
| Packet loss | What share of packets did not arrive | Diagnosing dropouts and pauses |
For streaming you need a stable speed sufficient for the video quality. For calls, check latency under load: a fast file download can be accompanied by choppy audio.
How to test a protocol on your own line
- Stop background downloads for the duration of the comparison.
- Keep the same device, network connection and speed test server throughout.
- Measure the connection without the VPN as a baseline.
- Choose one VPN server that supports the protocols being compared.
- Run three measurements of each variant within one short time window, alternating between them.
- Record the speed, latency without load and under load, packet loss and jitter, if the test shows them.
- Test video or a call with the variant that gave the most stable results.
Change one parameter at a time. Different servers make it impossible to attribute the difference to the protocol. Settings are described in the guide on how to change the VPN protocol.
If your task is to compare VLESS variants and Hysteria2 on your own line before paying for a plan, CitadelVPN lists both connection types in its subscription. Start with the trial access: 5 days, 2 devices and 5 GB, once per account, no card required. Update the subscription in a compatible client and check that both variants are available in the same location. Keep an eye on the remaining allowance: speed tests consume traffic quickly.
Frequently asked questions about speed
Is WireGuard always faster than OpenVPN?
No. If the results are close, compare the median of three measurements and the spread, then repeat the check at your usual video-viewing time.
Why is the speed lower with TCP?
Retransmissions of lost packets increase waiting time. If UDP is unavailable, a working TCP connection remains a useful option.
How do I check that the server is not the problem?
Repeat the measurements on a different server with the same protocol. A noticeable difference will indicate the influence of the server or route.
What to choose for your network
Start with WireGuard and compare it with OpenVPN UDP under identical conditions. On a lossy line, additionally test Hysteria2; evaluate VLESS together with its transport and protection. For video, choose stable throughput; for calls, add checks of latency, jitter and packet loss. Make your decision based on a repeatable result on your own network.