WireGuard® is a VPN protocol and the software that implements it, created by Jason A. Donenfeld and included in the Linux kernel since version 5.6. A protocol is the set of rules two computers follow to build an encrypted tunnel between them; the software is the code that follows those rules. WireGuard is unusual in that the rules fit in a short paper and the reference code is small enough to read in an afternoon, which is the property everything else here follows from.
A protocol is not an app
When an app such as NetCloak says it uses WireGuard, it means the tunnel between your phone and the server speaks WireGuard. The app around that tunnel, with its buttons, its session clock and its ads, is the app maker's own work. Two apps can both use WireGuard and behave nothing alike, and the protocol says nothing about what the operator keeps on the server at the far end. Those are separate questions, and this article is only about the first one.
Why the size of the code matters
The Linux implementation of WireGuard is a few thousand lines of code. The protocols it replaced run to hundreds of thousands. That is not a boast about elegance; it is a statement about who can check it. A security researcher can read the whole of WireGuard and hold it in their head, which is why it was reviewed thoroughly enough to be accepted into the kernel that runs most of the internet. The project lists the formal verification work done on the protocol itself.
The cryptography, by name
WireGuard does not negotiate ciphers. It uses one fixed set, chosen for being fast on ordinary processors without special hardware, which is exactly the processor in a phone. The protocol page lists them; here is what each does.
- Noise framework. The Noise handshake pattern that lets two parties who know each other's public keys agree on a shared secret in one round trip.
- Curve25519. The elliptic curve used for that key agreement. Your phone and the server each generate a private key, exchange public keys, and arrive at the same secret without ever sending it.
- ChaCha20-Poly1305. ChaCha20 scrambles every packet with that secret; Poly1305 stamps each packet with a check so a tampered packet is thrown away rather than decrypted. On a phone this runs faster than AES without a hardware helper.
- BLAKE2s. The hash function used inside the handshake to mix keys and derive new ones.
What a handshake every two minutes means for your battery
WireGuard rotates its session keys by performing a fresh handshake roughly every two minutes while traffic flows, and only when traffic flows. If your phone is idle, so is the tunnel: no keepalive chatter, no timers waking the radio. That is why a WireGuard tunnel left connected overnight costs noticeably less battery than the older designs that held a session open with constant heartbeats. The project's own performance page covers throughput; the battery effect on a phone comes from the silence.
Roaming: wifi to mobile without dropping
Older VPN protocols bind a tunnel to your IP address, so when your phone leaves the wifi and picks up mobile data the tunnel breaks and has to be rebuilt. WireGuard identifies you by your public key, not your address. When the phone moves networks, the next encrypted packet simply arrives from a new address and the server updates its notion of where you are. From the phone's side, the tunnel never went away.
The silent tunnel: the one thing an app has to watch
That same design has a consequence that most VPN apps handle badly. WireGuard has no concept of a connection being "up" or "down"; there is only the last time a handshake succeeded. If the server removes your key, or the network quietly stops delivering packets, the tunnel on your phone stays configured and keeps reporting itself as connected while carrying nothing. The protocol will never tell the app. The app has to watch the handshake age itself and decide when silence has gone on too long. NetCloak does exactly that: when a tunnel has not handshaked for three minutes on a network that is otherwise working, it ends the session and tells you, rather than showing a green shield over a dead connection.
What's the difference between VPN and WireGuard?
A VPN is the thing you want: an encrypted tunnel that carries your traffic to another computer before it reaches the internet. WireGuard is one way of building that tunnel, alongside OpenVPN and IKEv2. Every WireGuard app is a VPN; not every VPN uses WireGuard.
What WireGuard does not do
It is worth being as exact about the limits as about the strengths, and the project is, on its Known Limitations page.
- It does not make you anonymous. The server at the far end sees your real address, because it has to send packets back to you. What that server keeps is the operator's decision, not the protocol's.
- It does not hide that you are using a VPN. WireGuard packets have a recognisable shape on the wire. Anyone watching your connection can tell a tunnel is there, even though they cannot see inside it.
- It is not post-quantum by default. Curve25519 would not survive a large quantum computer. The protocol has an optional pre-shared key to add a quantum-resistant layer, which most consumer apps, NetCloak included, do not use today.
How NetCloak uses it
NetCloak ships the official WireGuard tunnel library for Android and nothing else: no config files to import, no QR codes, no second protocol to fall back to. When you tap connect, the app generates a fresh key for that session, the server hands back the tunnel settings, and the tunnel is up. When the session ends the key is thrown away. The rest of what the app does around the tunnel, the timed sessions and the clock, is described on the WireGuard page and how it works.