Windscribe offers up to 6 connection protocols, depending on your device. All protocols are setup for maximum protection so you will not be compromising your security by choosing whichever protocol you want, or letting the Windscribe app automatically select the protocol for you.

However, which protocol performs best in terms of speed and connection success may depend on your specific set up.

Quick Summary

WireGuard and IKEv2 perform the fastest. IKEv2 is easier to block though.

OpenVPN (UDP and TCP) works well but will be a bit slower than WireGuard and IKEv2.

On restricted networks, you can use Stealth or WStunnel to try and get around the restrictions. These will be slower than WireGuard, IKEv2 and OpenVPN.

WireGuard

Latest next-generation VPN protocol that offers the best speeds in optimal conditions (ie. no network VPN blocking). Can connect via 6 different ports. Often the best performing protocol and the default chosen by the Windscribe app when using Automatic Connection Mode.

IKEv2

Offers fastest connection times and high speeds on most networks. However it can be blocked fairly easily as it only works on Port 500. If WireGuard is giving you any issues, this is a great second choice.

OpenVPN (UDP)

OpenVPN over the UDP protocol. De facto VPN standard for many years, usually the faster OpenVPN protocol but can be blocked. Can connect via 6 different ports. OpenVPN will usually perform slower than WireGuard and IKEv2 due to how it operates on a system.

OpenVPN (TCP)

OpenVPN over TCP protocol. Helpful on restrictive networks. Can connect via 11 different ports. Similar performance to OpenVPN (UDP). More versatile due to port availability in case port blocking is an issue on a network.

Stealth

The Stealth protocol is just the OpenVPN protocol but masked to look like HTTPS traffic. Very helpful on restrictive networks. Can connect via 11 different ports. Stealth uses Stunnel under the hood to encrypt your VPN tunnel a second time using TLS. This makes it look like any other regular web traffic which means it's highly unlikely to get blocked. 

Due to the second layer of encryption, Stealth will perform slower than WireGuard, IKEv2 and OpenVPN. It should only be used if the other faster protocols are not connecting. 

WStunnel

WStunnel is very similar to Stealth where an OpenVPN tunnel will be masked to look like WebSocket traffic. Helpful on restrictive networks as the VPN is harder to identify. Only works via port 443. WStunnel should only be used in case any other protocol doesn't work as it will be slower than the WireGuard, IKEv2 and OpenVPN protocols.

Automatic VPN Protocol Selection

The Windscribe app is great at automatically choosing the best protocol for you. If WireGuard works, it will default to that. If the connection fails with WireGuard, it will attempt to connect via IKEv2, then OpenVPN (UDP), OpenVPN (TCP), then Stealth, and finally WebSocket. The first protocol that connects successfully will be saved for that network so that it doesn't cycle through them each time you connect.

Manual VPN Protocol Selection

The app also lets you choose your protocol manually if you want. In order to manually change your protocol, go to Preferences > Connection > Connection Mode and set this to Manual. Then you'll get two dropdowns, one for Protocol and one for the corresponding Ports on that protocol. You have to reconnect to Windscribe when you change the protocol/port in order to activate it.

Which VPN Protocol is Most Secure?

All our protocols offer maximum encryption so there is no compromise when choosing the one you want to use.

Sometimes with enough resources, a network administrator can detect the fact that a VPN is being used (but not see any actual data going to the VPN server) using deep packet inspection. If this is a concern for you, you can try using the Stealth protocol as this will just end up looking like any secure web traffic. Keep in mind that this does not fully mitigate VPN detection. If a VPN server's domain or IP is known to the network administrator, they will know you're communicating with a VPN server. However, this sort of detection requires a lot of resources so it's often reserved for large scale VPN blocking such as in China or Russia.