What Is AmneziaWG? The WireGuard Fork Built for a Stable Connection
A standard WireGuard handshake is a very specific shape: a 148-byte initiation packet followed by a 92-byte response, sent over UDP with a handful of predictable header values. That consistency is exactly what makes WireGuard fast — and exactly what makes it easy for automated network filters to fingerprint. AmneziaWG exists to solve that second half of the problem without touching the first.
What AmneziaWG actually is
AmneziaWG is a fork of the WireGuard-Go implementation, built by the team behind the Amnezia VPN project. It keeps WireGuard’s cryptographic core completely untouched — Curve25519 for key exchange, ChaCha20-Poly1305 for encryption, the same handshake logic — so the security guarantees you’d expect from WireGuard are still there. What changes is the transport layer: the part of the connection that a network observer actually sees.
In short, AmneziaWG is WireGuard with its recognizable “shape” scrambled, so a connection looks less like a template and more like ordinary background noise.
Why plain WireGuard struggles on some networks
Network filtering has gotten more sophisticated. According to research on Great Firewall detection techniques, unmodified WireGuard traffic can be identified in as little as 30 seconds through handshake signature matching, and modern DPI (deep packet inspection) systems increasingly rely on machine-learning models that classify a flow by packet timing and entropy patterns within roughly the first 100 packets — no need to even read the payload. Some regional filtering regimes documented in 2026 explicitly target WireGuard and IKEv2 even on non-standard ports.
None of this is a flaw in WireGuard’s cryptography — the encryption itself is not broken. The issue is purely metadata: fixed packet sizes and predictable timing are enough for a classifier to guess “this is WireGuard” without decrypting a single byte.
How AmneziaWG changes the traffic pattern
AmneziaWG layers several obfuscation techniques on top of the standard WireGuard transport:
- Junk packets — configurable decoy packets sent before the real handshake, breaking the “first packet is always X bytes” assumption.
- Header randomization — the fixed message-type headers WireGuard normally uses are replaced with randomized values.
- Variable-size padding — packet lengths no longer sit at fixed, easily-matched sizes.
- Protocol mimicry — traffic shape is adjusted so it doesn’t present a single uniform template to a classifier.
The result is a connection that carries the same underlying WireGuard protocol but doesn’t hand a network filter the clean, repeatable signature it’s looking for.
AmneziaWG vs. plain WireGuard
| WireGuard | AmneziaWG | |
|---|---|---|
| Encryption | Curve25519 / ChaCha20-Poly1305 | Same — unchanged |
| Handshake size | Fixed (148 / 92 bytes) | Randomized with junk packets |
| Packet headers | Fixed, predictable values | Randomized |
| Detectability by DPI | High — fingerprintable in seconds | Significantly reduced |
| Speed overhead vs. WireGuard | Baseline | Minimal — same lightweight core |
Setting it up: what actually happens
- You install the RunVPN app and sign in — Google, email, or Telegram.
- The app fetches its configuration automatically. There’s no manual key exchange, no config file, no QR code to scan — AmneziaWG’s parameters are provisioned for you the moment you log in.
- You tap connect. The app negotiates the obfuscated handshake in the background and establishes the tunnel.
That’s the entire flow — there’s no protocol picker or settings screen to configure, which matters because AmneziaWG’s obfuscation parameters (junk packet counts, header values) need to be consistent between client and server to work correctly.
What this means for everyday use
- Public Wi-Fi at a cafe or airport — your traffic is encrypted and doesn’t present an obvious VPN signature to network monitoring on that shared network.
- Mobile networks with aggressive traffic shaping — a connection that isn’t flagged as “VPN” is less likely to be throttled by pattern-based shaping rules.
- Everyday privacy — no-logs handling means what you do inside the tunnel isn’t retained on RunVPN’s side.
FAQ
Is AmneziaWG slower than WireGuard? No. The obfuscation layer adds minimal overhead — the core protocol and encryption are identical to WireGuard, which is already one of the fastest VPN protocols available.
Do I need to configure AmneziaWG manually? No. In the RunVPN app, configuration happens automatically after you sign in — there’s nothing to import or set up by hand.
Is AmneziaWG less secure than WireGuard because it’s modified? No. The obfuscation operates entirely at the transport layer. The cryptographic handshake and encryption (Curve25519, ChaCha20-Poly1305) are unchanged from upstream WireGuard.
Does RunVPN only use AmneziaWG? AmneziaWG is the default protocol. RunVPN also runs VLESS-Reality (XTLS-Vision) under the hood for added resilience — you don’t need to choose between them manually.
Fast, encrypted, and hard to fingerprint — that’s the point of AmneziaWG. Download RunVPN and connect in seconds, or read more about VLESS-Reality, the other protocol running under the hood.