A VPN protocol is the set of rules and message formats used to establish, maintain, and carry traffic through a VPN tunnel. WireGuard, OpenVPN, and IKEv2/IPsec are common examples. The protocol available to you can depend on the provider, operating system, app version, and whether you use the provider’s app or a manual configuration.
The protocol name matters, but the option actually available on your device matters more. A provider may support OpenVPN on Windows but not macOS, add post-quantum key exchange only to app-based WireGuard connections, or use an “Automatic” setting that chooses a server rather than a protocol.
We reviewed public documentation from 20 consumer VPN providers to compare those differences. This is a documentation audit, not an installation, speed, leak, or cryptographic test.
Publisher disclosure: This report was produced by BearVPN, a VPN provider. BearVPN was not included in the 20-provider sample. We reviewed public vendor documentation; we did not install the apps, capture network traffic, test performance, or independently verify vendor security and post-quantum claims.
VPN Protocols in 60 Seconds
A VPN protocol controls how a device and VPN server establish and maintain the protected path that carries traffic. It is related to encryption, authentication, routing, and transport, but it is not the same thing as any one encryption algorithm.
WireGuard
WireGuard is an open-source VPN protocol designed around a relatively small codebase and a fixed set of modern cryptographic choices. It normally transports packets over UDP. Providers can still build their own key-management systems, privacy controls, obfuscation layers, multihop features, or branded implementations around it.
That distinction matters. Two providers can both list WireGuard while offering different platform support, manual configuration options, connection modes, and post-quantum features.
OpenVPN
OpenVPN is an established open-source protocol with broad platform and manual-configuration support. It can use UDP, which is generally selected for lower overhead, or TCP, which may be useful when UDP is unavailable or unreliable.
OpenVPN TCP and OpenVPN UDP are transport choices within the OpenVPN family, not two unrelated base VPN protocols. Some providers also wrap OpenVPN in TLS, WebSocket, or another layer to make its traffic harder for a network filter to identify.
IKEv2/IPsec
IKEv2 is commonly used with IPsec and is often integrated through operating-system networking frameworks. It can handle changes between Wi-Fi and mobile networks efficiently, which helps explain why some providers offer it on mobile or Apple platforms.
In this audit, IKEv2/IPsec was also one of the most platform-dependent options. A provider-level statement that it is “supported” did not necessarily mean it appeared in every app.
Branded protocols and obfuscation
Provider-created names can describe different technical layers. Lightway and Hydra are presented as vendor-developed tunnel technologies. NordLynx is built around WireGuard. VyprVPN says Chameleon uses OpenVPN and changes its traffic metadata. Windscribe’s Stealth and WStunnel wrap OpenVPN in other transports.
Those examples should not be placed into one undifferentiated “protocol count.” A protocol and an encryption algorithm are also related but not identical; see our separate explanation of VPN encryption and tunnel protection.
Key Findings at a Glance
- 19 of 19 providers with complete evidence documented WireGuard support. WireGuard was universal in the complete-evidence sample, but its platform and configuration scope varied.
- 16 of 19 directly documented OpenVPN as a current option. Mullvad had removed it, Mozilla VPN did not offer it, and Hotspot Shield’s Hydra was not double-counted as a selectable OpenVPN option.
- 17 of 19 documented manual protocol selection. Mullvad currently centers its service on WireGuard, while Mozilla VPN did not document a base-protocol menu.
- 6 of 19 published some form of post-quantum protection claim. Default state, platform coverage, rollout status, and manual-configuration support differed.
We reviewed 20 providers. Nineteen had enough current official documentation for complete protocol-level coding. IPVanish remains in the comparison table but was excluded from these denominators because we could not build a sufficiently complete, current official documentation chain without filling gaps from third-party reviews.
The figures describe a purposive sample of consumer VPN services, not the entire VPN market. They measure what providers documented, not what BearVPN independently verified.
Figure 1. Documented protocol indicators across the 19 providers with sufficiently complete official evidence. The categories are separate indicators, not a product score.
VPN Protocols Compared Across 20 Providers
The table separates base protocols from branded technologies and obfuscation. “Not publicly confirmed” means the reviewed official material did not support a firm conclusion; it does not mean the feature is absent.
Documentation checked: November 10, 2026
The full evidence dataset contains 40 fields covering platforms, automatic-mode type, obfuscation, manual configuration, post-quantum scope, page dates, conflicts, and evidence status: download the full dataset.
Protocol quantity is not a score. A longer menu does not automatically establish stronger security, better performance, or clearer privacy practices.
WireGuard Was Universal in the Complete-Evidence Sample—But Its Scope Was Not
All 19 providers with complete official evidence documented WireGuard or a branded implementation built on it. That makes WireGuard the only base protocol common to the entire complete-evidence sample.
The apparent uniformity disappears when platform and configuration details are added. CyberGhost documents WireGuard across its main apps but explicitly says it does not support manual WireGuard configuration. Surfshark says its post-quantum layer applies to WireGuard connections made through its apps, not manual WireGuard configurations. Bitdefender says WireGuard on macOS requires macOS Ventura 13.3 or later.
Mullvad and Mozilla VPN were the two providers in the complete-evidence sample whose current consumer documentation centered on one base VPN protocol: WireGuard. Even then, their products were not identical. Mullvad documents multiple WireGuard obfuscation methods and quantum-resistant tunnel settings. Mozilla VPN documents a simpler WireGuard-based service without a protocol menu.
Branded implementations add another layer. NordVPN describes NordLynx as built around WireGuard. That lets it enter the WireGuard count, but NordLynx remains a provider-specific implementation with its own product behavior and documentation.
The finding therefore does not mean “all 19 offer the same WireGuard.” It means all 19 publicly documented WireGuard as part of their current service.
OpenVPN Remained Common, Even as Some Providers Moved Away From It
Sixteen of the 19 complete-evidence providers directly documented OpenVPN as a current option. Its continued presence reflects broad platform support, configurable UDP and TCP transports, and an established manual-configuration ecosystem.
The exceptions illustrate why dated documentation matters. Mullvad announced that it was removing OpenVPN from its app and server network as it moved to WireGuard plus newer anti-censorship methods. Mozilla VPN uses WireGuard without an OpenVPN option. Hotspot Shield says Hydra is based on the OpenVPN standard, but its current protocol menu did not present a separate OpenVPN choice, so we did not count Hydra a second time as direct OpenVPN support.
Proton VPN represents a transition rather than a simple yes-or-no state. Its current matrix still lists OpenVPN for the Linux GUI, while a 2026 architecture article explains a broader move away from OpenVPN in official apps. NordVPN similarly documents a move from OpenVPN-based obfuscated-server behavior toward NordWhisper.
OpenVPN TCP and UDP also need careful wording. They can change reliability, overhead, and how a network treats the connection, but they remain transports for OpenVPN. Counting them as two unrelated protocols would inflate comparisons.
Protocol Availability Changed by Operating System
A provider-level “yes” does not guarantee that the same protocol appears in every app.
Figure 2. Four examples of provider protocol menus that changed by operating system. The matrix reflects the official documentation reviewed and may change with app versions.
Norton provides one of the clearest examples. Its current matrix lists WireGuard, Mimic, and OpenVPN TCP/UDP on Windows and Android. On macOS and iOS, the documented choices are WireGuard, Mimic, and IPsec instead.
CyberGhost’s overview lists WireGuard on Windows, macOS, Android, iOS, Linux, Android TV, and Fire TV. OpenVPN is listed for Windows, Android, Linux, Android TV, and Fire TV, while IKEv2 is listed for Windows, macOS, and iOS. A single brand-level row would hide those differences.
Other examples include:
- IVPN: OpenVPN and WireGuard across its apps, with IKEv2 limited to iOS in the reviewed support page.
- TunnelBear: WireGuard and OpenVPN on all four listed consumer platforms, but IKEv2 absent from Android.
- Avast SecureLine: OpenVPN-centered automatic behavior on Windows and Android, compared with IPsec-centered behavior on macOS and iOS.
- Bitdefender VPN: WireGuard and IKEv2 on iOS, while desktop and Android documentation includes OpenVPN variants.
- Proton VPN: a current matrix shaped by platform support and an ongoing protocol-architecture migration.
Manual configurations can differ again. A router may support an OpenVPN profile even when the provider’s native app offers a branded protocol. Conversely, an app-based post-quantum layer may not follow a downloaded WireGuard configuration into a third-party client.
This is why a useful comparison needs at least three levels: provider, platform, and connection method.
What Does “Automatic” Actually Select?
“Automatic,” “Smart,” “Recommended,” and “Best” are not standardized protocol terms. In the reviewed documentation, similar labels controlled at least four different things.
Figure 3. “Automatic” could describe protocol selection, protocol or port fallback, an obfuscation method, or server selection. Similar labels did not necessarily control the same part of a VPN connection.
1. Base-protocol selection
CyberGhost’s Windows app can automatically choose among supported protocols. Hotspot Shield recommends Auto or Smart to select a protocol for the network. Norton and Bitdefender also describe Automatic as a protocol-selection setting.
2. Protocol or port fallback
Windscribe says its Automatic mode chooses a protocol and port and remembers what works on a network. PureVPN documents automatic protocol selection and a fallback option. Avast describes platform-specific fallback: OpenVPN may fall back to Mimic on Windows or Android, while IPsec may fall back to Mimic on Apple platforms.
3. Obfuscation-method selection
Mullvad currently uses WireGuard as its base tunnel. Its Automatic anti-censorship behavior can try a suitable WireGuard port or obfuscation method after a normal connection fails. Calling that “automatic protocol selection” would imply a choice between WireGuard and OpenVPN that the current app no longer makes.
4. Server selection rather than protocol selection
Mozilla VPN’s Recommended option chooses a server based on factors such as distance and availability. PIA’s desktop “Choose Automatically” wording can also refer to server selection, while its iOS documentation separately describes an Automatic protocol option.
The practical lesson is simple: read the setting description, not only its label. An automatic mode may change the tunnel, transport, wrapper, port, or server—or some combination of them.
Proprietary Protocols, Branded Variants, and Obfuscation Are Not the Same Thing
Eleven of the 19 complete-evidence providers documented a branded or proprietary tunnel, protocol variant, or branded connection technology. That number should not be treated as a uniform technical category.
Vendor-developed tunnel technologies
ExpressVPN presents Lightway as its own protocol and links to an open-source core. Hotspot Shield presents Hydra as a proprietary protocol based on established TLS/OpenVPN concepts. Astrill describes OpenWeb and StealthVPN as proprietary. Norton and Avast offer Mimic as a vendor-developed option intended to work on networks that restrict ordinary VPN traffic.
The public evidence behind these technologies differs. A product name alone does not show whether the complete implementation is open source, independently audited, built on a standard protocol, or limited to a particular app.
Branded variants built on standard protocols
NordVPN says NordLynx is built around WireGuard. VyprVPN says Chameleon uses an unmodified OpenVPN 256-bit connection and scrambles metadata. These are branded technologies, but the provider explicitly connects them to a standard base protocol.
We did not make that mapping when a provider did not publish it.
Obfuscation and transport wrappers
Some features preserve the base tunnel while changing how its traffic appears on the network:
- Windscribe Stealth wraps OpenVPN in TLS/Stunnel, while WStunnel uses WebSocket.
- Mullvad documents LWO, QUIC, Shadowsocks, and UDP-over-TCP around WireGuard.
- IVPN offers V2Ray with WireGuard across its apps and obfs4 for desktop OpenVPN.
- TunnelBear documents GhostBear as an option for restrictive networks on selected platforms.
These features can be important where a network blocks recognizable VPN traffic, but they should not automatically be counted as new base protocols.
Product features that are not protocols
Split tunneling, server recommendation, Multi-Hop, a kill switch, and a standalone proxy layer solve different problems. Hotspot Shield’s “Smart VPN,” for example, refers to split tunneling in one part of the product, even though “Smart” also appears in protocol-selection material. hide.me’s StealthGuard is a traffic-binding or blocking feature, not an obfuscation protocol.
Clear classification produces a shorter list, but a more technically accurate one.
Six Providers Published Post-Quantum Claims, but the Scope Differed
Six of the 19 complete-evidence providers published some form of post-quantum protection claim in the sources reviewed: ExpressVPN, Surfshark, NordVPN, Mullvad, IVPN, and Avast.
The claims did not describe one shared state:
- ExpressVPN documents ML-KEM-related protection for current Lightway and its WireGuard implementation.
- Surfshark describes a post-quantum layer for WireGuard connections made through its apps, while excluding manual configurations.
- NordVPN documents post-quantum protection with NordLynx and a rollout that has varied by platform.
- Mullvad documents quantum-resistant WireGuard tunnels, with desktop defaults and separate mobile status considerations.
- IVPN says WireGuard connections are quantum resistant by default in its apps through a post-quantum key exchange.
- Avast exposes a post-quantum setting in a specific product/platform context, which should not be generalized to every SecureLine edition or device.
“Supported” can therefore mean default, optional, rolling out, app-only, or limited to one product surface. A downloaded manual configuration may not inherit an app’s additional key-exchange layer.
We recorded whether a provider published a claim and the scope it described. We did not verify the cryptographic implementation or treat the claim as an independent certification. We also avoid the phrase “quantum-proof,” which makes a stronger promise than these documents support.
Which VPN Protocol Should You Use?
There is no single protocol choice that is best for every device, network, and provider implementation.
There is also no universal “most secure VPN protocol” based on a name alone; implementation quality, platform integration, configuration, and update practices all matter.
If a provider’s Automatic setting works reliably, most users do not need to change protocols simply because one name appears newer. First confirm what the automatic mode controls. It may select a protocol, retry a port, add obfuscation, or only choose a server.
WireGuard is now widely available and is commonly chosen for efficient everyday connections. OpenVPN remains useful where users need broad compatibility, TCP/UDP control, or manual profiles. IKEv2/IPsec can be a practical mobile or Apple-platform option when the provider documents it for that device.
On a restrictive school, workplace, hotel, or national network, switching between ordinary base protocols may not be enough. A provider’s documented obfuscation or censorship-resistance option may be more relevant, although this audit did not test whether any option succeeds on a particular network.
Use this checklist:
- Check the protocol menu on your actual operating system.
- Confirm whether Automatic selects a protocol or something else.
- Check whether the feature requires the provider’s app.
- Look for platform, version, region, and subscription limits.
- Use the provider’s current troubleshooting guidance before relying on an old comparison.
A protocol name alone does not predict real-world speed. Our separate review shows how routes and test methods changed VPN speed-retention results.
What a Protocol List Cannot Tell You
A protocol list does not establish whether a VPN keeps activity logs, whether its app contains vulnerabilities, or whether a kill switch blocks every transition leak. It also cannot prove that a service will work on a particular network or that one provider’s implementation is faster than another’s.
The presence of WireGuard does not independently verify a provider’s server-side privacy practices. The presence of a proprietary protocol does not make a service inherently safer or less trustworthy. A post-quantum claim is not a substitute for implementation details, scope, independent review, and future updates.
Protocol support is only one layer of VPN behavior. See what a VPN hides—and what it does not. Connection-drop protection is also a separate implementation question; compare what 20 providers document in our VPN kill switch audit.
Methodology
We selected 20 consumer VPN providers to represent widely known services, different company groups, standard and proprietary protocol strategies, and different documentation styles: Proton VPN, ExpressVPN, Surfshark, NordVPN, Private Internet Access, CyberGhost, IPVanish, Windscribe, Mullvad, IVPN, TunnelBear, hide.me, VyprVPN, Hotspot Shield, PureVPN, Mozilla VPN, Astrill VPN, Norton VPN, Avast SecureLine, and Bitdefender VPN.
The sample was purposive, not a random sample of the global VPN market. BearVPN was excluded because it publishes this report.
Sources and evidence priority
We used official product pages, help-center articles, technical documentation, release notes, and official open-source repositories. We did not use third-party reviews to fill missing product fields.
For each provider, we coded:
- OpenVPN, including whether TCP and UDP were stated;
- WireGuard and provider-specific variants;
- IKEv2/IPsec and other standards-based protocols;
- proprietary or branded protocols;
- Automatic, Smart, or Recommended modes and what they selected;
- manual protocol selection;
- Windows, macOS, Android, iOS/iPadOS, Linux, TV, and router/manual availability;
- obfuscation or Stealth features and their relationship to a base protocol;
- post-quantum claims and stated scope;
- deprecated or removed protocols;
- platform caveats, page dates, documentation conflicts, and evidence status.
We used Not publicly confirmed when the reviewed official material did not support a clear conclusion. That status is not the same as No. We used Conflict when current official pages supported different conclusions and neither could be safely ignored.
Twenty providers appear in the comparison table. Nineteen entered the complete-evidence denominators. IPVanish was retained as an incomplete-evidence row because we could not obtain a sufficiently complete current official protocol matrix without relying on third-party summaries.
We did not install apps, download configurations, capture packets, measure speed, test leaks or censorship resistance, inspect source code, or validate cryptographic implementations.
Limitations
Official documentation can change after publication, and several pages did not display an update date. App menus can also vary by version, operating system, app-store distribution, region, subscription, or staged rollout.
This audit records documented support, not actual behavior. A feature can be documented incorrectly, implemented differently, or changed before its help page is updated. Conversely, a feature may exist even when we could not find sufficiently clear public documentation.
Provider terminology is not standardized. “Protocol,” “mode,” “Smart,” “Stealth,” and “Automatic” can refer to different technical layers. We normalized those terms conservatively but did not reverse-engineer the implementations.
Post-quantum entries are vendor claims with a recorded scope, not independent verification. Likewise, an open-source base protocol does not mean every provider-specific service component is open source.
The sample should not be used to estimate percentages for the entire VPN industry.
Conclusion
WireGuard appeared across every complete-evidence provider in this sample, but protocol availability was still fragmented by platform, app, and configuration method. OpenVPN remained common, while several providers were migrating away from older paths or adding branded alternatives and obfuscation layers.
The practical question is not only which protocols a provider advertises. Check which option is available on your device, what an automatic mode actually controls, whether a branded feature is a base tunnel or a wrapper, and whether an additional claim applies to the provider’s app or also to manual connections.
Protocol names are useful. Their documented scope is more useful.
Sources and Reproducibility
The primary official source for every provider is linked in the comparison table. Important secondary sources used to interpret scope and documentation changes include:
- Proton VPN protocol architecture update
- ExpressVPN connection troubleshooting and protocol selection
- Surfshark website-access troubleshooting
- NordWhisper platform guide
- PIA iOS protocol page
- CyberGhost WireGuard documentation
- Windscribe protocol guide
- Mullvad app guide
- IVPN server status and protocol notes
- TunnelBear restrictive-network guidance
- hide.me platform troubleshooting
- Hotspot Shield Hydra security description
- PureVPN WireGuard setup
- Mozilla VPN open-source client
- Astrill app modes
- Norton automatic and manual protocol settings
- Avast One SecureLine protocol settings
- Bitdefender protocol feature availability
Corrections: Product documentation changes over time. If you find a newer official source or a platform detail that should be updated, please contact BearVPN with the provider, platform, and source URL.
