When you open a VPN app, you may see a setting called "Protocol" with names like WireGuard. Most people never touch it, and that is fine. But if you have ever wondered what those names mean, this article explains it without maths or jargon.

What a VPN protocol is

A protocol is simply an agreed set of rules. Your device and the VPN server need to agree on three things before they can talk privately:

  1. Who is who. Each side must be sure it is talking to the right partner, not an impostor.
  2. Which secret keys to use. They need shared keys that nobody else knows.
  3. How to package the data. Every piece of traffic has to be locked, labelled and sent in a way the other side can unlock.

A VPN protocol is the recipe that covers all three. Different recipes make different trade-offs between simplicity, speed and how the traffic looks on the network.

Encryption in one paragraph

Encryption turns readable data into scrambled data that only someone with the right key can turn back. The EFF's Surveillance Self-Defense guide describes encryption as a key way to protect information from bad actors and service providers, and notes that when it is used correctly it is virtually impossible to break. Modern encryption also detects tampering. If anyone changes even a tiny part of an encrypted message in transit, the receiver notices and throws it away.

There are two kinds of keys involved:

  • Public and private keys. Think of a padlock you hand out freely (the public key) and the only key that opens it, which you keep (the private key). This is how two strangers can set up a secret without meeting.
  • Session keys. Once the two sides trust each other, they create fresh, temporary keys for the actual data. These are fast to use and are replaced regularly.

What a "handshake" is

The handshake is the short conversation at the start of a connection. It is where both sides prove who they are and agree on session keys. Imagine two people meeting at a train station: they exchange a pre-agreed phrase, confirm each other's identity, and then switch to a private language that only they understand for the rest of the trip.

A good handshake is quick, hard to fake, and doesn't reveal the keys to anyone listening.

WireGuard: modern and deliberately small

WireGuard was designed by Jason Donenfeld and is described in a public whitepaper. Its main idea is to keep things small and simple, because simpler code is easier to check for mistakes. The project's site says it aims to be easy to configure and deploy, and meant to be "comprehensively reviewable by single individuals" rather than requiring large teams to audit.

Here is what makes WireGuard different, in plain terms:

  • A fixed set of strong building blocks. Older protocols let each side negotiate from a long menu of options, which adds complexity and room for error. WireGuard uses one modern set. According to its protocol page, that set includes ChaCha20 and Poly1305 for encrypting and protecting data, Curve25519 for agreeing on keys, BLAKE2s for hashing and HKDF for deriving keys.
  • A handshake built on Noise. WireGuard's handshake is based on the Noise Protocol Framework, a well-studied way of designing key exchanges. The handshake is short: one message from your device, one reply from the server, and the tunnel is ready.
  • Keys that keep changing. WireGuard's documentation says the handshake repeats every few minutes to rotate keys, providing perfect forward secrecy. In everyday words: even if a key were somehow stolen later, it couldn't be used to unlock traffic from earlier sessions.
  • Quiet by design. A WireGuard server doesn't answer packets that don't prove they come from a known key. To an unauthorised scanner, the server simply doesn't respond.
  • Comfortable with moving devices. If your phone switches from Wi-Fi to mobile data, WireGuard can keep the tunnel going from the new address without a full reconnection.

This combination is why WireGuard has become a popular choice for modern VPN apps.

Where TLS fits in

You already use another important protocol every day without noticing: TLS, the "S" in HTTPS. When the padlock appears in your browser, TLS is protecting the page. The current version, TLS 1.3, is defined in RFC 8446. It also uses a handshake to agree on keys, then encrypts the conversation.

TLS matters for VPNs because some VPN protocols are built on top of it. Their traffic is wrapped in the same kind of encrypted connection used by ordinary secure websites.

Why some networks treat VPN traffic differently

Encryption hides what is inside a packet, but every protocol still has a recognisable outline. Think of envelopes: you can't read the letter, but you can see the envelope's size, shape and the pattern in which letters arrive. Network equipment can look at those outlines, a technique often called traffic classification or deep packet inspection.

Organisations use this for many reasons. A company network may only allow certain kinds of traffic. A hotel network might limit anything it doesn't recognise. Some internet providers manage traffic by type.

Because WireGuard has a fixed, compact message format, its packets can be easy to recognise. That is not a weakness in its encryption, which stays strong, but it means some networks can identify it and slow it down or stop it.

This is why some modern protocols focus on how traffic looks, not just on how it is locked. There are two broad approaches:

  • Adjusting the outline. Changing packet sizes or adding padding so the traffic doesn't match a simple, fixed pattern.
  • Using a familiar envelope. Carrying the tunnel inside a TLS connection so that it resembles the encrypted web traffic that most networks already handle.

Both approaches keep your data encrypted all the way between your device and the VPN server. Their aim is a reliable, private connection. Always follow the laws and network rules that apply to you.

The protocols in the VPNRice apps

VPNRice offers three protocols, plus an Auto mode:

  • WireGuard. The standard protocol described above. A good default on most home and mobile networks.
  • RiceGuard. WireGuard with extra packet obfuscation. It keeps WireGuard's cryptography but changes the outline of the packets.
  • RiceGuardX. Built on VLESS with REALITY, a TLS-based protocol, so the tunnel is carried inside a TLS connection.
  • Auto. The app chooses a protocol for you and switches if a connection doesn't work.

All three plus Auto are available on Android and Android TV. On iPhone and iPad, Auto doesn't use RiceGuardX. The Windows app offers WireGuard, RiceGuardX and Auto. The Chrome and Firefox extensions work differently: they are browser proxies that route only your browser's traffic through VPNRice servers (sites you open over HTTPS stay encrypted end to end).

Which one should you choose?

For most people, the honest answer is: leave it on Auto. If you want to experiment:

  • Use WireGuard when your network is ordinary and you want a simple, well-understood setup.
  • If a connection is unstable on a particular network, Auto will try another protocol; you can also switch manually.

Whichever you pick, the basics stay the same: strong encryption, a quick handshake, and keys that change regularly.

Key takeaways

  • A protocol is the rulebook your device and the VPN server follow to talk privately.
  • The handshake proves identities and sets up fresh keys.
  • WireGuard is modern, compact and uses a fixed set of strong cryptography.
  • Some networks recognise VPN traffic by its outline, even though they can't read it.
  • Newer protocols change how the traffic looks while keeping it encrypted.

Curious to see these protocols in action? Download VPNRice, open the Protocol setting, and switch between them to see which works well on your network.