How many providers qualify for this list?

9 of 11. The other 2 are excluded because they do not meet the requirement, and they are named at the bottom of the page rather than quietly dropped.

What does this ranking ignore?

Throughput, which depends on your line more than on the protocol.

9 of 11 qualify · Updated August 13, 2026

VPNs with a clean WireGuard implementation

WireGuard is fast and small enough to be audited properly, which is why nearly everyone now ships it. The differences are in what sits on top: some providers wrap it in a proprietary layer to solve WireGuard’s IP-retention problem, and that layer is not open to inspection. This page separates the providers running it plainly from the ones running a variant.

The rule for this page. Providers shipping WireGuard under its own name alongside OpenVPN. Ordered by protocol score.

Answer

Mullvad, then Proton VPN

WireGuard, OpenVPN. The strongest privacy posture of any provider in this dataset, and the only one we cannot earn a commission from.

Visit Mullvad

We earn nothing from Mullvad. This link is included because the ranking says it belongs here.

Providers that qualify, ordered by the rule above
#	Provider	Deciding fact	Protocol and crypto stack	Overall
1	Mullvad Unpaid	WireGuard, OpenVPN	9/10	85.5
2	Proton VPN	WireGuard, OpenVPN, IKEv2, Stealth	9/10	90.0
3	IVPN Unpaid	WireGuard, OpenVPN	9/10	82.5
4	Surfshark Unpaid	WireGuard, OpenVPN, IKEv2	9/10	75.5
5	Private Internet Access Unpaid	WireGuard, OpenVPN	9/10	73.0
6	Windscribe Unpaid	WireGuard, OpenVPN, IKEv2	9/10	67.0
7	CyberGhost Unpaid	WireGuard, OpenVPN, IKEv2	9/10	70.0
8	PureVPN	WireGuard, OpenVPN, IKEv2	9/10	69.0
9	FastestVPN	WireGuard, OpenVPN, IKEv2	8/10	48.0

Why these, in order

1. Mullvad

85.5

WireGuard, OpenVPN. The strongest privacy posture of any provider in this dataset, and the only one we cannot earn a commission from.

Against it: No native app for Apple TV, Android TV or games consoles.

Visit Mullvad

2. Proton VPN

90.0

WireGuard, OpenVPN, IKEv2, Stealth. The best-documented security stack in this dataset, and the only free tier we consider safe to recommend.

Against it: Refunds are prorated against usage, not returned in full.

Visit Proton VPN

3. IVPN

82.5

WireGuard, OpenVPN. A deliberately small, transparent operation that costs more than the market and makes no attempt to hide it.

Against it: One of the smallest server networks in this dataset.

Visit IVPN

4. Surfshark

75.5

WireGuard, OpenVPN, IKEv2. The cheapest credible option per device, weakened by a Nine Eyes jurisdiction and common ownership with NordVPN.

Against it: Netherlands jurisdiction participates in the Nine Eyes agreement.

Visit Surfshark

5. Private Internet Access

73.0

WireGuard, OpenVPN. The only provider here whose no-logs claim has been tested by a court rather than only by an auditor — but it is a US company.

Against it: United States jurisdiction, inside the Five Eyes agreement.

Visit Private Internet Access

What did not qualify, and why

Excluded providers are named rather than omitted. If one of them is the VPN you already pay for, this tells you exactly which requirement it misses.

Provider	Why it is not on this list
NordVPN	Protocol stack is NordLynx (WireGuard), OpenVPN, IKEv2.
ExpressVPN	Protocol stack is Lightway, OpenVPN, IKEv2.

Questions

Which VPNs run WireGuard without a proprietary layer on top?: Mullvad. WireGuard, OpenVPN. Providers shipping WireGuard under its own name alongside OpenVPN. Ordered by protocol score.
How many providers qualify for this list?: 9 of 11. The other 2 are excluded because they do not meet the requirement, and they are named at the bottom of the page rather than quietly dropped.
What does this ranking ignore?: Throughput, which depends on your line more than on the protocol.