AmneziaWG vs WireGuard: What Actually Changes Under the Hood
A WireGuard handshake opens with a fixed message type — the byte 0x01 — followed by a predictable field layout. That single byte is often enough for a deep packet inspection (DPI) system to flag the session before any real traffic moves. AmneziaWG was built specifically to remove that fingerprint while keeping WireGuard’s speed and cryptography intact. Here’s what actually changes between the two, and why it matters for a stable connection on networks that are picky about VPN traffic.
Same Cryptographic Core, Different Wire Signature
AmneziaWG isn’t a new VPN protocol built from scratch — it’s a fork of WireGuard-Go that keeps the same Noise protocol handshake, Curve25519 key exchange, and ChaCha20-Poly1305 encryption. The security guarantees don’t change. What changes is everything an outside observer on the network can actually see: packet sizes, header bytes, and the timing pattern around the handshake.
WireGuard was designed for raw speed and a minimal codebase, not for hiding from network operators — that was never part of its design brief. Read more about how the obfuscation layer is configured on the AmneziaWG protocol page.
How DPI Actually Spots Plain WireGuard
Standard WireGuard traffic is easy to single out because its handshake message always starts with the same type field, and packet sizes around a session follow a narrow, repeatable pattern. Researchers tracking the behavior of large-scale DPI systems have reported vanilla WireGuard handshakes getting flagged within roughly 30 seconds of a session starting on some of the most aggressive filtering infrastructure in use today.
Newer detection methods go further. Network-security writeups from 2026 describe DPI pairing machine-learning models with packet-timing and entropy analysis to fingerprint WireGuard from as few as 100 packets — without ever decrypting a single byte.
A DPI system doesn’t need to break the encryption. It only needs your traffic to look statistically different from everything else on the wire.
That’s the real attack surface: not the cipher, but the shape of the traffic.
What AmneziaWG Changes on the Wire
AmneziaWG’s obfuscation layer, documented in the project’s own technical docs, works by disrupting that shape before the real handshake even starts:
- Junk packets (Jc, Jmin, Jmax) — the client sends a configurable number of junk packets of random size before the real handshake, breaking the fixed-size pattern DPI looks for.
- Randomized headers — the message type byte and other header fields no longer match WireGuard’s known constants.
- Message padding — packet lengths vary so session traffic doesn’t cluster into a recognizable size distribution.
- Signature packets — extra decoy traffic shaped to resemble other common protocols rather than a VPN handshake.
The protocol’s 2.0 release extended this into fuller header and packet-size mimicry, going beyond the junk-packet-only approach of earlier versions. None of this touches the underlying encryption — it changes what an outside observer sees, not what the two endpoints actually exchange.
WireGuard vs AmneziaWG at a Glance
| WireGuard | AmneziaWG | |
|---|---|---|
| Encryption | ChaCha20-Poly1305, Curve25519 | Same |
| Handshake pattern | Fixed, recognizable | Randomized junk + headers |
| Speed overhead | None (baseline) | Small, from junk packets |
| DPI resistance | Low — flaggable in seconds | High — built against it |
| Best fit | Open networks, home routers | Networks that throttle recognizable VPN patterns |
What Happens When You Connect
- You sign in to the RunVPN app — Google, email, or Telegram.
- The app fetches its configuration automatically from RunVPN’s servers — there’s nothing to import or paste by hand.
- A tunnel opens using AmneziaWG by default, tuned for a stable connection even on networks that throttle recognizable VPN traffic patterns.
- You tap connect, and traffic routes through the tunnel — the obfuscation parameters are already set correctly on both ends.
For particularly picky networks, RunVPN also keeps VLESS-Reality available as a second protocol option, running over the Xray engine.
FAQ
Is AmneziaWG slower than WireGuard? Junk packets add a small amount of overhead, but on everyday use — browsing, streaming, messaging — the difference isn’t something you’ll notice. The core encryption path is identical to WireGuard’s.
Does AmneziaWG replace WireGuard entirely? No — it’s built on top of it. Same key exchange, same cipher suite. The obfuscation layer is additive, not a redesign of the security model.
Why does this matter if my network isn’t restrictive? Even on open networks, a less recognizable traffic pattern means less exposure to automated traffic classification in general — one part of a broader privacy posture, not a single silver-bullet fix.
Do I need to configure any of this myself? No. RunVPN sets up AmneziaWG automatically after you sign in — there’s no manual profile, junk-packet setting, or handshake parameter to touch.