WireGuard
The quickest way to understand WireGuard is a number: about four thousand lines of code. OpenVPN with its dependencies runs to hundreds of thousands. That is not bragging but an engineering choice with consequences. A codebase that size can be read end to end and audited, so fewer flaws hide in it. It fits inside the operating system kernel, so data does not shuttle between kernel and userspace, and a connection comes up in milliseconds rather than seconds. The price is rigidity: the cipher suite is fixed and not selectable. Nothing has to be negotiated, but nothing can be swapped either.
In short
WireGuard fits where speed and instant recovery matter: mobile devices, switching between networks, a permanent tunnel on a router. That same simplicity makes it recognisable — its packet structure is distinctive and constant, so the connection can be identified without inspecting content. Which is why networks that analyse traffic see its modifications rather than WireGuard itself.
Frequently asked
Why does WireGuard connect faster than others?
Because it negotiates nothing. Protocols with configurable cryptography open a connection with a negotiation: each side lists what it supports and they settle on a common option. WireGuard fixes the set, so there is nothing to discuss and the handshake collapses to a single exchange. The same property gives it instant recovery after a network change.
Can the ciphers in WireGuard be changed?
No, and that is deliberate. Cipher choice is a source of misconfiguration and an opening for downgrade attacks, where two sides settle on the weakest option they share. WireGuard removed the option entirely: if the cryptography ages, the protocol version changes rather than a user setting.