PhoenixVPN

Blog

WireGuard vs OpenVPN in 2025: which one should you actually use?

By David at PhoenixVPN • • 5 min read

WireGuard is the default protocol on every PhoenixVPN client. That’s because for most people, in most situations, it’s the right choice. But “most” isn’t “all” — and there are scenarios where OpenVPN is still the better tool.

TL;DR

  • Use WireGuard if you want speed, low latency, and don’t have specific reasons to use something else. ~90% of users.
  • Use OpenVPN-UDP if WireGuard is being throttled or blocked on your network.
  • Use OpenVPN-TCP if you’re on a highly restrictive network (corporate, hotel, captive portal) that only allows HTTP/HTTPS.

Why WireGuard is the default

WireGuard is the new kid. It launched in 2016, was merged into the Linux kernel in 2020, and has been gaining ground ever since.

Its main advantages:

  • Small attack surface. ~4,000 lines of code vs ~100,000+ for OpenVPN. Easier to audit, fewer places for bugs to hide.
  • Fast. Sub-second connection times. Throughput consistently 20–40% higher than OpenVPN on the same hardware.
  • Better on mobile. Roams between cellular and Wi-Fi without dropping the tunnel.
  • Lower battery use. It runs in the kernel; OpenVPN runs in userspace.

Where OpenVPN still wins

WireGuard runs over UDP only. If your network blocks UDP — or aggressively throttles it — WireGuard will be slow or just won’t connect.

OpenVPN can run over TCP on any port, including 443 (HTTPS). That means it looks like normal web traffic and gets through almost any firewall. If you’re on a corporate network, hotel Wi-Fi, or a country with restrictive networks, OpenVPN-TCP-443 is often the only thing that works.

OpenVPN also has more tuning knobs. If you’re into squeezing the last few percent out of a specific link, you can do things with OpenVPN you can’t with WireGuard.

What we recommend

Open the PhoenixVPN app. Leave the protocol on Automatic. The client will use WireGuard by default and switch protocols if it can’t connect — most of the time you’ll never notice.

If you specifically need to force a protocol, the option is one tap away in Settings → Connection.

< Back to blog