VPN encryption

Updated 21 September 2026 · How we research

"Military-grade encryption" is a marketing phrase, not a specification. What actually matters is which cipher protects your data, how the two ends agree on keys, and whether those keys are discarded afterwards.

The three jobs encryption does

Confidentiality

A symmetric cipher — normally AES-256-GCM or ChaCha20-Poly1305 — makes the payload unreadable to anyone carrying it.

Key exchange

Elliptic-curve Diffie-Hellman, usually Curve25519, lets both ends derive a shared secret without ever sending it.

Authentication

Certificates or pre-shared keys prove the server is the one you meant to reach, which is what stops an interception attack.

The ciphers you will actually see

AEAD means the cipher provides both confidentiality and integrity in one step, so tampering is detected rather than silently passed through.

Cipher	Type	Used by	Notes
AES-256-GCM	AEAD block cipher	OpenVPN, IKEv2/IPsec	Hardware accelerated on most modern CPUs via AES-NI, which makes it very fast on desktops
ChaCha20-Poly1305	AEAD stream cipher	WireGuard, OpenVPN	Faster than AES on processors without AES-NI, which includes many mobile and older chips
Curve25519	Key agreement	WireGuard, modern TLS	Fast, with a design that avoids several classes of implementation mistake
SHA-2 / BLAKE2s	Hashing	Various	Integrity checking and key derivation

AES-256 versus AES-128

Both are unbroken. AES-256 has a larger key and therefore a larger margin against future attacks, but a correctly implemented AES-128 tunnel is not a weak one. Cipher strength is rarely the part of a VPN that fails; configuration and leak handling are.

Perfect forward secrecy

Forward secrecy means each session uses ephemeral keys that are thrown away afterwards. If a server's long-term private key were later compromised, recorded traffic from past sessions still could not be decrypted. WireGuard rekeys frequently by design; OpenVPN and IKEv2 achieve the same through ephemeral Diffie-Hellman. Treat its absence as disqualifying.

What encryption does not do

It does not hide that you are using a VPN. Traffic volume and timing remain visible — see obfuscation.
It does not protect traffic that never enters the tunnel. A DNS query sent to your ISP is unencrypted regardless of the cipher — see DNS leak protection.
It does not stop the provider seeing your destinations, which is a policy and architecture question — see logging explained.
It does not block malware, phishing or browser fingerprinting.

Frequently asked questions

Is AES-256 better than ChaCha20?

Neither is broken, and the choice is about hardware rather than strength. AES-256 is faster where the processor has AES-NI acceleration, which covers most desktops and laptops. ChaCha20-Poly1305 is faster on processors without it, which is why WireGuard standardised on it and why it often wins on phones and small routers. Either is a reasonable default; a provider offering both is not offering you more security.

What does 'military-grade encryption' mean?

Nothing specific. It usually refers to AES-256, a public NIST standard that anyone can implement and that protects nothing by virtue of the name. The phrase appears in marketing because it sounds exclusive. Judge a provider on which cipher suite and key exchange it documents, and on whether it says so plainly, rather than on the adjective.

Does a longer key mean better security?

Not in any way you will notice. AES-128 and AES-256 are both unbroken, and the practical attacks on a VPN target implementation, key exchange and endpoint security rather than the cipher. A provider advertising a larger number is telling you about its marketing, not about a threat it has removed.

What is perfect forward secrecy and does it matter?

It means session keys are negotiated per session and discarded, so recording today's traffic and obtaining a long-term key later does not decrypt it. It matters more than cipher choice for anyone worried about retrospective decryption, and it is worth checking a provider documents it rather than assuming.