WireGuard vs OpenVPN vs VLESS Reality: which VPN protocol should you use?

Most VPN apps hide the protocol behind a "Connect" button, and that's fine until something goes wrong: the VPN is slow, it drains the battery, or it won't connect on the hotel Wi-Fi. Then the protocol matters. This guide compares the three you are most likely to meet on Android today, in plain words, and tells you which to pick.

The quick comparison

All three encrypt your traffic properly when set up correctly. The differences are in speed, battery, and how easy they are to recognise and block.

WireGuard: fast, small, light on the battery

WireGuard is the modern default. It uses a fixed set of current cryptography (Curve25519, ChaCha20, Poly1305, BLAKE2) instead of a menu of options, and its code is small enough to audit. It became part of the Linux kernel in version 5.6 in March 2020, and Android added kernel support right after (history on Wikipedia).

What it's good at on a phone:

• Speed and battery. Little work per packet, and it stays silent when nothing is sent.
• Roaming. When you move from Wi-Fi to mobile data, the tunnel continues without a full reconnect.

Its weakness: it runs over UDP with a recognisable handshake. Many hotel, school and office networks block UDP or detect WireGuard, and then it simply doesn't connect.

OpenVPN: the veteran

OpenVPN dates from 2001 and is built on TLS and the OpenSSL library. It's extremely configurable, runs over UDP or TCP, and has been reviewed and deployed for two decades. That's why many company VPNs and older apps still use it.

On Android it's the heavier choice: more processing per packet, more control traffic to keep the connection alive, and a slower reconnect when the network changes. Running it over TCP port 443 can help on restrictive networks, but its handshake is still recognisable, so networks that look for VPNs can still spot it.

VLESS with Reality: VPN traffic that looks like HTTPS

VLESS is a lightweight proxy protocol from the Xray project. On its own it's simple. The interesting part is Reality, which replaces the usual TLS setup. The server answers the handshake with the real certificate of an existing, well-known website. To anyone watching the network, the connection looks like a normal HTTPS visit to that site on port 443, so there's no VPN-shaped handshake to block.

What that means in practice:

• It connects where WireGuard and OpenVPN are blocked, for example on guest Wi-Fi that only allows web traffic. Our guide to VPNs on hotel and office Wi-Fi explains how those blocks work.
• It's fast, close to WireGuard for everyday browsing and streaming, though it runs over TCP and carries a bit more overhead.
• It's newer and less standard. It comes from an open-source community project rather than a standards body, and fewer apps support it.

Looking like ordinary HTTPS isn't a licence to break rules. If your school or employer forbids VPNs on its network, that rule still applies.

Which protocol should you use on Android?

• Everyday use, home and mobile data: WireGuard. Fastest and best for the battery.
• Hotel, campus, office or airport Wi-Fi that won't connect: VLESS with Reality.
• A company or older service that only offers OpenVPN: OpenVPN, ideally over UDP.
• Don't want to think about it: an automatic mode that tries WireGuard first and falls back to Reality.

Battery is often the deciding factor on a phone. We cover that in detail in does a VPN drain your battery.

How SimpleV uses these protocols

• Automatic (default): WireGuard first, VLESS with Reality when WireGuard can't get through. If WireGuard is blocked, the app stops retrying it for a while, so you're not left waiting.
• Manual choice: pick WireGuard or Xray Reality in Settings if you prefer one. An explicit choice is never switched silently.
• Why no OpenVPN: on a phone, WireGuard does its job faster and with less battery, and Reality covers the networks where WireGuard is blocked. A third protocol would add weight without adding a case the other two miss.
• Free: 500 MB a day with no account. Premium: no daily limit and more locations.

FAQ

Is WireGuard more secure than OpenVPN?

Both are secure when configured properly. WireGuard's advantage is simplicity: one modern set of algorithms and a small codebase leave less room for configuration mistakes. OpenVPN's advantage is a very long track record.

What does VLESS Reality mean?

VLESS is the proxy protocol that carries your traffic. Reality is the layer that makes the connection look like a normal TLS session with a real website, so networks can't easily tell it apart from ordinary HTTPS.

Why does WireGuard not work on some Wi-Fi networks?

It uses UDP and has a recognisable handshake. Networks that allow only web traffic, or that look for VPN patterns, block it. A protocol on TCP port 443 that looks like HTTPS, such as Reality, usually still connects.

Is VLESS Reality slower than WireGuard?

Slightly, because it runs over TCP and adds a little overhead. For browsing, messaging and video you will rarely notice. WireGuard stays the better default where it works.

Which protocol uses the least mobile data?

WireGuard has the smallest overhead, about 4–5% on top of your traffic. The differences between protocols are small compared with what your apps use; see how much data a VPN uses.