Keys, not sessions
Configuration is an exchange of public keys, the way SSH works. There is no session to negotiate, no connection to manage, and no daemon whose state you have to reason about.
WireGuard
A VPN you can hold in your head. Two keys, one network interface, and cryptography chosen once and chosen well.
“WireGuard” and the WireGuard logo are registered trademarks of Jason A. Donenfeld, reproduced unmodified to identify the project this page is about.
Most VPN software asks you to learn it. You configure a daemon, choose between cipher suites, manage connection state, and read logs to find out why the tunnel dropped. WireGuard asks for something much smaller: each machine gets a key pair, you tell each side the other’s public key, and the tunnel exists.
It runs inside the Linux kernel, which is unusual for a VPN and is most of why it’s fast. It also runs on Windows, macOS, BSD, iOS and Android.
Why people who care about this pick it
Section titled “Why people who care about this pick it”Small enough to read
The implementation is deliberately compact, so a single competent reviewer can audit it. Compare that to auditing IPsec or OpenSSL, where the codebase is large enough that even a well-resourced team is really only sampling.
No cipher menu
The primitives are fixed: one handshake, one AEAD, one hash. You cannot misconfigure WireGuard into a weak cipher, because there is no weak cipher to select. Upgrades happen by versioning the protocol, not by negotiation.
It survives the train
Peers may change IP address without dropping the tunnel. Move from wifi to mobile data and the connection follows you, with no reconnect step.
The idea worth understanding first
Section titled “The idea worth understanding first”WireGuard’s central trick is that a peer’s public key is its identity in the routing table. Each peer is configured with a list of source addresses that its key is permitted to use. When a packet arrives, it is decrypted, and the address it claims to come from is checked against the list belonging to the key that actually signed it. A packet from the wrong key is dropped, not routed.
That one table does authentication and routing at the same time, which is why there is so little else to configure. The project calls it cryptokey routing.
How it works Cryptokey routing, the network interface, roaming, and namespaces.
Cryptography and security The Noise handshake, the fixed primitives, and where to report a vulnerability.
Known limitations What WireGuard deliberately does not do, in the project's own accounting.
About this page
Section titled “About this page”This is a student redesign, built for a course, of the site at wireguard.com. It is not official and not endorsed. Every technical claim here is drawn from the project’s own documentation and its whitepaper; where I was unsure, I left the claim out rather than guess. For anything authoritative — current downloads, the manual pages, the protocol specification — go to the real site.