WireGuard
A modern VPN protocol, around 4,000 lines of code, designed to be small enough to audit properly.
Glossary
AES-256
What is AES-256?
AES-256 is a symmetric encryption cipher with a 256-bit key, standard in OpenVPN and IKEv2 configurations. It is the number every VPN advertises, usually as "military-grade encryption".
Why it matters
It is the number every VPN advertises, usually as "military-grade encryption".
What most explanations leave out
The cipher is not where consumer VPNs differ. All of them use something adequate, and none of them is broken at the cipher level. WireGuard does not use AES at all — it uses ChaCha20, which is not weaker, just different. Marketing that leads with the cipher is drawing attention away from the parts that do differ, like logging and jurisdiction.
Related terms
Perfect forward secrecy
Deriving each session key from an ephemeral key exchange and then destroying it, so a future compromise of the long-term key cannot decrypt past recorded traffic.
Questions
- What is AES-256?
- A symmetric encryption cipher with a 256-bit key, standard in OpenVPN and IKEv2 configurations.
- Why does AES-256 matter when choosing a VPN?
- It is the number every VPN advertises, usually as "military-grade encryption".
- What do most explanations of AES-256 leave out?
- The cipher is not where consumer VPNs differ. All of them use something adequate, and none of them is broken at the cipher level. WireGuard does not use AES at all — it uses ChaCha20, which is not weaker, just different. Marketing that leads with the cipher is drawing attention away from the parts that do differ, like logging and jurisdiction.
Terms are defined here because they appear in our scoring rubric or in provider reviews, not to fill a glossary.