So that tension — engineering excellence versus controversial corporate ownership — is the real story here. But most VPN review sites won’t touch it.

Speed Benchmark — Lightway Protocol on a 1 Gbps Line

We ran speed tests from a 1 Gbps fiber connection (Singapore) across five regions using iperf3 and Ookla Speedtest CLI. Each node got three runs; we took the median.

A few things stood out. Lightway TCP drops about 8 points below UDP but still beats OpenVPN. And the Asia node was predictably slower from Singapore — 832 Mbps on a Tokyo server is still impressive. So if your network blocks UDP, Lightway TCP is a solid fallback.

Streaming Performance — Six Platforms Tested

Streaming is where ExpressVPN earns its reputation. And our data backs that up.

Still, tests ran on June 23–24, 2026. Streaming availability shifts — we’ll update this if platforms start blocking ExpressVPN’s IP ranges.

Privacy — The Kape Question

On the engineering side, ExpressVPN’s privacy posture is strong. TrustedServer runs on RAM-only hardware — every reboot wipes all data. And PwC has verified the no-logs claim annually since 2019. Lightway passed a Cure53 audit too. Our own tests confirmed no DNS, IPv6, or WebRTC leaks.

But here’s the elephant. Kape Technologies (formerly Crossrider) built its original business on ad-injecting software. Malwarebytes classified it as a “potentially unwanted program” in 2015. And then Kape pivoted into privacy, acquiring CyberGhost, ZenMate, PIA, and ExpressVPN for over $1.5 billion combined.

So what does that mean for you?

If you’re a streaming-first user who wants something that just works — ExpressVPN’s product is excellent. The engineering team built genuinely good tech. And the audits confirm the privacy claims. So Kape’s ownership is a corporate structure question, not a product quality one.

But if you’re privacy-sensitive — if VPN ownership history matters — ProtonVPN or Mullvad are cleaner alternatives. ProtonVPN is backed by a Swiss privacy foundation with zero ad-tech baggage. It’s slower (~720 Mbps on the same line), but the ownership story is simpler. See our ProtonVPN vs NordVPN comparison for the full breakdown.

ExpressVPN vs the Alternatives

NordVPN edges ahead on raw speed — NordLynx hit 900+ Mbps in our NordVPN quick review. But ExpressVPN wins on streaming breadth and simplicity. And ProtonVPN is the privacy-first choice. For a deeper dive on streaming specifically, check our best VPN for streaming guide.

Final Verdict

Choose ExpressVPN if: you stream across multiple regions, want a simple app, and the Kape ownership question doesn’t bother you.

Skip it if: Kape’s history is a dealbreaker, or you want open-source transparency.

Bottom line: ExpressVPN’s product is genuinely good in 2026. The Lightway protocol competes with WireGuard-based alternatives, and the streaming unblocking is the best we’ve tested this year. Still, the Kape ownership question isn’t going away — and we think it’s more honest to put that front and center than to bury it in a footnote.

For streaming-first users, ExpressVPN delivers the best streaming unblocking we’ve tested this year. For privacy purists, ProtonVPN is the recommended alternative.

Our take after running benchmarks across multiple providers for this comparison: WireGuard-based solutions are the right answer for 8 out of 10 users in 2026. But the exceptions matter — especially when you factor in how commercial VPNs like NordVPN and ExpressVPN have modified the protocol layer to create their own derivatives.

And here’s the thing: the VPN protocol space has changed more in the last three years than in the previous fifteen. The question isn’t WireGuard vs OpenVPN anymore. It’s which version of WireGuard your VPN runs, and whether that matters for your specific setup.

WireGuard vs OpenVPN vs IKEv2: Protocol Origins & Design

Understanding why these protocols perform differently starts with their origin stories.

WireGuard was created by Jason A. Donenfeld in 2016 with one goal: make a VPN that’s actually simple. The entire implementation sits at roughly 4,000 lines of kernel code — compare that to OpenVPN’s 500,000+ lines. And WireGuard was merged into the Linux kernel in 2020 (kernel 5.6) and has since become the default on Android, most Linux distributions, and increasingly on macOS and iOS. Its design philosophy is “crypto is the spec” — one encryption suite (Curve25519 + ChaCha20 + Poly1305), no negotiable ciphers.

OpenVPN predates both competitors. Created by James Yonan in 2001, it was designed for the dial-up and early broadband era. It runs entirely in userspace — portable to almost any platform, but every packet travels through a TLS handshake and encryption pipeline that adds overhead. Its strength is flexibility: TCP or UDP, swappable cipher suites, works through almost any firewall. But that flexibility is also its weakness — more moving parts, more can break.

IKEv2 (Internet Key Exchange version 2) is a different beast entirely. It’s a protocol standard managed by the IETF, not a specific software implementation. Microsoft baked IKEv2 into Windows 7, and Apple uses it as the backbone for the native VPN client on iOS and macOS. Its signature feature is MOBIKE (Mobility and Multihoming) — a protocol extension that maintains the VPN tunnel when you switch between Wi-Fi and cellular networks.

And these three design origins explain almost everything about how they perform in 2026.

VPN Protocols at a Glance

Right away, the lines-of-code gap jumps out. WireGuard’s tiny codebase means independent auditors can review every line — something practically impossible with OpenVPN’s half-million-line codebase. But there’s more to it than size. So let’s look at real numbers.

Speed Test: WireGuard vs OpenVPN vs IKEv2 Benchmarks

We compiled speed test data from our NordVPN review and ProtonVPN review, plus industry benchmarks. All tests on a 1 Gbps fiber line with 5 ms baseline ping.

A few highlights worth calling out. NordVPN’s NordLynx — which wraps WireGuard in a double-NAT layer to mask static IP assignment — still managed 862 Mbps, the fastest in our test battery. And Lightway, ExpressVPN’s custom protocol built on WolfSSL, came close at 830 Mbps. And both are WireGuard derivatives under the hood, reinforcing our core point: WireGuard’s design is simply faster, and commercial VPNs build on top of it rather than compete with it.

But raw speed isn’t everything. OpenVPN’s 350 Mbps on UDP is more than enough for 4K streaming (roughly 25 Mbps) or most remote work. Still, the question is where those extra milliseconds matter.

I tested the handshake difference myself. So I set up a DigitalOcean VPS and connected to the same server location (Frankfurt) using each protocol back-to-back. WireGuard negotiated the handshake in under 1 second. IKEv2 completed in about 3 seconds. OpenVPN took roughly 12 seconds. For someone connecting and disconnecting frequently — say, on a laptop during a workday — those differences add up fast.

WireGuard vs OpenVPN vs IKEv2: Security & Privacy Audit

WireGuard’s design eliminates logging by default — there’s simply no mechanism in the protocol to log connections. No IP address storage, no session tracking. But OpenVPN can be configured either way — “no logs” depends entirely on the specific deployment. And IKEv2 relies on the underlying IPsec stack, which on Windows exposes some logging at the OS level — worth checking if surveillance resistance is your concern.

WireGuard vs OpenVPN vs IKEv2: Compatibility & Special Cases

Here’s where OpenVPN fights back. WireGuard uses UDP exclusively, so it can’t penetrate networks that block non-TCP traffic. Corporate firewalls, hotel Wi-Fi portals, and government-level DPI block UDP outright. But OpenVPN can run over TCP/443 — indistinguishable from regular HTTPS traffic to a passive observer.

Still, IKEv2 has a trick of its own. It can run on TCP/80 or TCP/443 via IPsec NAT-T, making it nearly as firewall-friendly as OpenVPN TCP. And for mobile users, IKEv2’s MOBIKE extension maintains the tunnel when switching between Wi-Fi and 5G — I tested this by walking between floors in my apartment while on a video call, and IKEv2 held the connection without a hiccup. WireGuard dropped and reconnected in about 2 seconds, which is acceptable but not smooth.

Even so, WireGuard’s roaming has improved since kernel 5.15, though it still requires a new handshake when the IP changes. IKEv2’s MOBIKE handles this at the protocol level — zero-notice handoffs useful for journalists and travelers.

That said, compatibility cuts both ways. OpenVPN’s flexibility means more can go wrong — cipher suites, certificate management, and protocol versions create a configuration matrix many IT teams describe as the second-hardest problem. WireGuard’s minimalism is deliberate: nothing to configure except the peer’s key and endpoint.

The Commercial VPN Twist — NordLynx, Lightway & Others

But this is the part most protocol comparisons miss. The protocol you’re using right now might not be “pure” WireGuard. Commercial VPN providers have been modifying the protocol layer to solve specific problems — and these modifications create a third dimension of choice.

NordLynx (NordVPN) takes standard WireGuard and wraps it in a double-NAT layer. Stock WireGuard assigns a static IP to each client — NordVPN’s fix places each connection behind two NAT layers so the server never sees the client’s real IP. The trade-off: slightly higher latency (our tests showed +2 ms on average) for the privacy gain. It still tops our speed charts at 862 Mbps.

Lightway (ExpressVPN) isn’t strictly WireGuard — it’s a custom protocol built on WolfSSL, a lightweight TLS library. But it shares the same design principles: minimal code, fast handshake, modern crypto. ExpressVPN claims it reconnects 50% faster than OpenVPN after network changes. And we verified this in our own testing: Lightway reconnected in under 1 second after a network disruption, compared to 3-5 seconds for WireGuard and 10+ seconds for OpenVPN.

AmneziaWG is a WireGuard fork designed for DPI bypass. It wraps WireGuard traffic in additional obfuscation layers — in our tests, it passed through networks that blocked standard WireGuard entirely. We covered it in our AmneziaWG quick review.

Wormhole (used by a smaller set of providers) is another WireGuard derivative with built-in traffic obfuscation. Still niche, but worth watching as DPI becomes more aggressive globally.

So the implication is clear: WireGuard isn’t a monolith anymore. When you evaluate a VPN in 2026, the question isn’t just “WireGuard vs OpenVPN” — it’s also “which version of WireGuard does this service run, and what have they modified?”

Which Protocol Should You Use? — Decision Matrix

Final Verdict: Which VPN Protocol Wins in 2026?

So three protocols, one conclusion: WireGuard-based solutions are the default choice for most users in 2026. The speed advantage is real, the codebase is auditable, and the ecosystem has matured enough for enterprise deployments.

But the exceptions still matter. If you’re behind a restrictive corporate firewall, IKEv2 or OpenVPN TCP are your only practical options. And if you need enterprise-grade authentication, OpenVPN’s two decades of deployment experience is an asset. The key takeaway: when choosing a commercial VPN, look past the protocol name — ask whether they run stock WireGuard or NordLynx, Lightway, or a custom fork. That distinction affects your speed, privacy, and experience.

Our recommendation: start with WireGuard as your default. If your VPN offers a WireGuard-based mode (NordLynx, Lightway, or stock), use it. Switch to IKEv2 or OpenVPN only when your network demands it. And treat the protocol implementation as a core part of your evaluation — it matters as much as server count and price.