Turn on a VPN and your speed drops. That's almost always true — but how much it drops depends far more on the VPN protocol than most people realize. The old guard, OpenVPN, can cut throughput dramatically on modest hardware. The newer protocol, WireGuard, was built specifically to make encryption fast. Here's how it all works, and how to measure the real impact on your connection.
Why a VPN Affects Speed at All
A VPN wraps your traffic in an encrypted tunnel. Every packet gets encrypted on your device, sent to a VPN server (often far away), decrypted, and sent on to the internet — and the reply travels the same path in reverse. That adds three costs:
- Encryption overhead — CPU work that caps throughput on weak hardware.
- Longer path — your traffic detours through the VPN server, adding latency and a distance penalty.
- Server capacity — a busy VPN server becomes a shared bottleneck at peak hours.
In short: encryption mostly limits your maximum throughput, while the server location mostly increases your latency. They're separate problems with separate fixes.
WireGuard vs. OpenVPN
WireGuard is a modern VPN protocol with a famously small codebase and a cryptographic design tuned for performance. Because it does far less work per packet, it routinely sustains much higher speeds than OpenVPN — especially on routers and older devices where OpenVPN bottlenecks at a fraction of your line speed.
| Factor | WireGuard | OpenVPN |
|---|---|---|
| Typical throughput on modest hardware | High — near line speed | Lower — CPU-bound |
| Latency overhead | Minimal | Low but higher |
| Setup complexity | Simple | More configuration |
| Device support | Growing quickly | Everywhere |
For a given VPN provider and server, WireGuard will usually deliver better throughput than OpenVPN on the same connection. That's why many services now default to it — Cloudflare's free WARP, for example, is built on WireGuard.
VPNs and Security: The Honest Tradeoff
It's worth separating what VPNs genuinely protect from what they don't. A VPN does encrypt traffic on untrusted networks (like public Wi-Fi) and hide your traffic from your ISP. It doesn't make you anonymous — the VPN provider sees what your ISP used to, and cookies and trackers still know who you are. The EFF's privacy guidance is a good reality check on what to expect.
The security-vs-speed tradeoff is simple: you trade a little speed and latency for encryption in transit. With WireGuard, that tradeoff is small enough to be invisible for most users.
How to Test Your VPN's Impact
Measuring is straightforward — run the same test twice:
- Baseline: run a speed test with the VPN off.
- With VPN: connect to the VPN server you'll actually use, then run the test again from the same device and location.
- Compare: download, upload, and ping in both runs.
Two things to check beyond raw speed:
- Latency jump: ping may rise by 10–50 ms depending on server distance. That's expected — what matters is whether it stays stable.
- Consistency: a VPN that swings wildly between runs is worse than one that's slightly slower but steady.
If throughput with the VPN is far below your baseline, try a closer server, switch the protocol to WireGuard, or test at a different hour to rule out server congestion.
The Bottom Line
Yes, a VPN costs you some speed — but a well-run WireGuard service on a nearby server costs surprisingly little. If you're seeing dramatic slowdowns, the fix is usually protocol or server selection, not giving up on the VPN. Test with and without, pick a closer server, and use the numbers instead of guessing.
Want context on what your baseline should be? Our good internet speed guide sets realistic expectations, and the latency vs. throughput article explains the two metrics you're actually measuring.