VPN Speed Test 2026: How Protocols Compare

Speed is the number one concern people have when choosing a VPN. Encryption adds overhead. Routing traffic through a remote server adds latency. But the gap between a well-optimized VPN and raw internet speed has narrowed dramatically — largely because of newer protocols like WireGuard.

This guide explains what actually affects VPN speed, how the major protocols compare, and how to get the best performance from your VPN connection.

What Affects VPN Speed

Before comparing protocols, you need to understand the four main factors that determine how fast your VPN connection will be. Protocol choice matters, but it''s not the only variable.

1. Server Distance

The physical distance between you and the VPN server is the single biggest factor in latency. Light travels through fiber optic cable at roughly 200,000 km/s, which sounds fast until you consider a connection from London to Sydney traverses approximately 17,000 km of cable — adding roughly 85ms of one-way latency before any processing occurs.

Rule of thumb: Choose the closest server to your actual location unless you specifically need to appear in another region. A server 500 km away will almost always outperform one 5,000 km away, regardless of protocol.

2. Server Load

VPN servers are shared resources. During peak hours, a popular server location may be handling thousands of simultaneous connections. Each connection competes for the server''s CPU (for encryption/decryption), memory, and network bandwidth.

Quality VPN providers manage this by deploying sufficient server capacity in popular locations and dynamically routing users to less-loaded nodes. RAM-only server architectures also help — without disk I/O overhead, servers can allocate more resources to connection handling.

3. Encryption Overhead

Every byte of data you send through a VPN must be encrypted on your device, transmitted, and then decrypted on the server (and vice versa). This process adds CPU load and packet-size overhead.

The overhead varies significantly by protocol:

WireGuard (ChaCha20-Poly1305): Minimal overhead. ChaCha20 is optimized for modern CPUs and runs efficiently without hardware acceleration. The entire WireGuard codebase is approximately 4,000 lines — orders of magnitude smaller than OpenVPN, which reduces processing complexity.

OpenVPN (AES-256-GCM): Moderate overhead. AES-256 benefits from hardware acceleration (AES-NI) on most modern processors, but OpenVPN''s userspace implementation and TLS handshake add latency compared to kernel-level protocols.

IKEv2/IPsec (AES-256): Low overhead on supported platforms. IKEv2 operates at the kernel level on iOS and macOS, which reduces context-switching costs. Reconnection is nearly instant, making it excellent for mobile devices that switch between Wi-Fi and cellular.

4. Your Base Connection Speed

A VPN cannot make your internet connection faster than its baseline. If your ISP connection delivers 50 Mbps, a VPN connection will deliver somewhere below that — typically 80-95% of baseline speed with modern protocols.

The one exception: if your ISP is throttling specific traffic types (streaming, torrents, gaming), a VPN can actually improve speeds by preventing the ISP from identifying and deprioritizing that traffic.

Protocol Speed Comparison

Here''s how the three major VPN protocols compare across key performance metrics. These represent typical real-world results — actual performance varies based on the factors described above.

WireGuard

Architecture: Kernel-level implementation, UDP-based, single round-trip handshake. Encryption: ChaCha20-Poly1305 for data, Curve25519 for key exchange, BLAKE2s for hashing. Codebase: ~4,000 lines.

Performance characteristics:

Throughput: Consistently achieves 85-95% of baseline connection speed. On gigabit connections, WireGuard routinely delivers 700-900 Mbps.

Latency: Adds 1-3ms on top of base latency to the server. The single round-trip handshake means connections establish in under 100ms.

Reconnection: Near-instant. WireGuard maintains cryptographic sessions that survive network changes, so switching from Wi-Fi to cellular doesn''t drop the tunnel.

CPU usage: Lowest of the three protocols. The small codebase and efficient cryptographic primitives mean less CPU work per packet.

Best for: General use, streaming, gaming, and any scenario where speed and battery life matter.

OpenVPN

Architecture: Userspace implementation, supports both TCP and UDP transport. Encryption: Configurable — typically AES-256-GCM or AES-256-CBC with HMAC-SHA256. Codebase: ~100,000+ lines.

Performance characteristics:

Throughput: Typically achieves 60-85% of baseline speed. On a 500 Mbps connection, expect 300-425 Mbps.

Latency: Adds 5-15ms depending on configuration. The TLS handshake requires multiple round trips, adding initial connection time.

Reconnection: Slower than WireGuard and IKEv2. A full TLS renegotiation is required after connection loss, which can take 2-5 seconds.

CPU usage: Higher than WireGuard due to userspace processing. Each packet crosses the kernel-userspace boundary twice.

Best for: Situations requiring maximum configurability or where TCP transport is needed to bypass restrictive firewalls. OpenVPN over TCP port 443 mimics HTTPS traffic, making it harder to block.

IKEv2/IPsec

Architecture: Kernel-level implementation on most platforms, UDP-based (ports 500 and 4500). Encryption: Typically AES-256 with SHA-256 and Diffie-Hellman key exchange. Codebase: Part of the OS kernel on iOS, macOS, and Windows.

Performance characteristics:

Throughput: Achieves 80-90% of baseline speed. Performance is very consistent because the kernel integration avoids context-switching overhead.

Latency: Adds 2-5ms. Slightly higher than WireGuard but lower than OpenVPN.

Reconnection: Excellent. IKEv2''s MOBIKE extension handles network transitions seamlessly — moving from Wi-Fi to cellular happens without dropping the VPN tunnel.

CPU usage: Low on platforms with native kernel support (iOS, macOS, Windows). Higher on Linux where it requires additional userspace components.

Best for: Mobile devices, especially iOS where IKEv2 has native kernel integration. Excellent for users who move between networks frequently.

Real-World Testing Methodology

If you want to test VPN speeds yourself, here''s a methodology that produces meaningful results:

Baseline first. Run 3 speed tests without a VPN active. Record the median download, upload, and ping.

Same server location. Connect to the VPN server closest to the speed test server. Testing against a server in Tokyo while your VPN exits in Amsterdam doesn''t tell you anything useful about protocol performance.

Test each protocol. Run 3 tests per protocol using the same VPN server and same speed test server. Record medians.

Test at different times. Server load varies throughout the day. Morning results may differ from evening results.

Use a wired connection. Wi-Fi introduces its own variability that can mask protocol performance differences.

Speed test tools:

Speedtest by Ookla (speedtest.net) — most widely used, tests against nearby servers

fast.com — Netflix''s speed test, good for measuring streaming-relevant speeds

LibreSpeed — open-source, self-hostable, no third-party tracking

How CasperVPN Optimizes for Speed

CasperVPN supports all three major protocols — WireGuard, OpenVPN, and IKEv2 — and defaults to WireGuard for the best balance of speed and security. Here''s what the architecture looks like under the hood:

RAM-only servers. All CasperVPN servers operate entirely in RAM. Beyond the privacy benefits, this eliminates disk I/O bottlenecks that can throttle connection throughput during peak loads.

Private DNS on every node. DNS resolution happens locally on the VPN server rather than querying an external DNS provider. This eliminates an extra network hop for every domain lookup, reducing page load times by 10-30ms.

Smart server selection. The CasperVPN app automatically recommends the server with the best combination of proximity and current load, so you don''t have to guess which server will be fastest.

Common Speed Issues and Fixes

If your VPN speed is lower than expected, work through these checks in order:

Switch protocols. If you''re on OpenVPN, try WireGuard. The throughput improvement is typically 20-40%.

Change servers. Even if a server is geographically close, it may be overloaded. Try a different server in the same region.

Check for ISP throttling. Some ISPs throttle VPN traffic on specific ports. Switching OpenVPN from UDP 1194 to TCP 443 can bypass this, as it looks identical to HTTPS traffic.

Disable unnecessary features. If you''re running split tunneling, double VPN, or an ad blocker through the VPN, each adds processing overhead. Disable features you don''t need for the current session.

Update your VPN app. Performance optimizations are shipped through app updates. Running an outdated client may mean missing protocol improvements.

Check your base connection. Run a speed test without the VPN. If your base speed is lower than expected, the issue is your ISP, not the VPN.

The Bottom Line

WireGuard has effectively solved the "VPN speed problem." With throughput at 85-95% of baseline and latency additions measured in single-digit milliseconds, the performance cost of encrypting your traffic is negligible for most users.

For mobile users who switch networks frequently, IKEv2 remains excellent due to its seamless reconnection. OpenVPN still has its place for maximum configurability and firewall bypass, but it''s no longer the default recommendation for performance-focused users.

The best approach: start with WireGuard, and only switch if you have a specific reason to use another protocol.

---

CasperVPN supports WireGuard, IKEv2, and OpenVPN with automatic protocol selection. RAM-only servers. No activity logs. Download CasperVPN →