A VPN protocol is the set of rules your device and the VPN server agree on: how to authenticate each other, how to encrypt traffic, and how to move packets through the tunnel. It decides more about your day-to-day experience than almost anything else in a VPN — speed, battery drain, and how the connection behaves from one network to the next.
The protocol landscape in 2026 looks very different from the OpenVPN era. Three families matter for most people, and they were built with different enemies in mind. Here's each one in plain English.
WireGuard: small, fast, and auditable
WireGuard was designed as a reaction to the bloat of older VPN protocols. Where OpenVPN and IPsec accumulated decades of options and legacy code, WireGuard fits in a few thousand lines — small enough for a person to read. It was merged into the Linux kernel in 2020 and has since become the default recommendation for general-purpose VPN use.
It uses a fixed, modern cryptographic suite (ChaCha20-Poly1305, Curve25519, BLAKE2s) instead of negotiable cipher menus, which removes a whole class of downgrade attacks. The handshake is quick, roaming between networks is seamless, and the low per-packet overhead makes it gentle on phone batteries.
The catch: WireGuard traffic is easy to recognize. Its handshake packets have a distinctive shape, and the project explicitly treats hiding from network filters as a non-goal. That gap produced variants like AmneziaWG, which keeps WireGuard's cryptography but pads and reshapes the identifiable packets.
Hysteria2: QUIC for hostile physics
Hysteria2 attacks a different problem: networks that are slow or lossy rather than censored. It runs on QUIC — the UDP-based transport underneath HTTP/3 — and uses congestion control tuned to keep throughput up when packets are being dropped, which is where traditional TCP-style backoff collapses.
That makes it strong on exactly the connections where VPNs usually feel painful: crowded public Wi-Fi, mobile data, and long-haul international routes. A side effect of speaking QUIC is that Hysteria2 traffic looks like ordinary HTTP/3 to the network.
VLESS+Reality: traffic that looks like ordinary HTTPS
VLESS is a lightweight tunnel protocol from the Xray ecosystem, and Reality is the TLS layer that made it famous. Older protocols that imitated HTTPS could be unmasked by "active probing" — a censor connects to the suspected server itself and checks whether it behaves like a real website. With Reality, the server presents the genuine TLS handshake and certificate of a real, well-known website: a probe gets a real site, and a client with the right key gets a tunnel. The result is traffic that looks like ordinary HTTPS.
That describes the design, not a promise about any network: TUKTUKVPN has not measured VLESS + Reality on networks that block VPNs, the Great Firewall included, and makes no claim about them. The trade-off is complexity and overhead compared with WireGuard.
Obfuscation vs DPI: the actual arms race
Deep packet inspection (DPI) is equipment that looks past a packet's address to its shape and contents: handshake patterns, packet sizes, timing. Since VPN payloads are encrypted, DPI doesn't read your data — it fingerprints the protocol. National firewalls, and plenty of hotel and campus networks, use it to identify and block tunnel traffic.
Obfuscation means making VPN traffic look like traffic a network normally allows, which in practice means ordinary HTTPS and QUIC. Reality borrows real TLS handshakes; AmneziaWG reshapes WireGuard's packets; Hysteria2 runs over QUIC like HTTP/3. DPI vendors keep learning new fingerprints and protocol authors keep changing their protocols, so no obfuscated protocol is a guarantee, and TUKTUKVPN makes no claim about networks that block VPNs.
So which protocol should you use?
It genuinely depends on the network, which is an unsatisfying answer if you have to choose by hand. As a rule of thumb: WireGuard on clean networks, Hysteria2 when the connection is lossy or far away, and VLESS+Reality when you want traffic that looks like ordinary HTTPS.
TUKTUKVPN's position is that you shouldn't have to make that call. The app runs all three families — VLESS+Reality, Hysteria2, and WireGuard/AmneziaWG — and switches automatically based on network conditions. We don't publish self-measured speed rankings between them, because those numbers depend on your ISP and route, not our lab. If you want the details behind any term here, the glossary covers DPI, no-logs, kill switches, and the rest; the FAQ answers the practical questions; and the 30-day money-back guarantee on your first purchase lets you test every protocol on your own networks.