Which protocol should I use?
Keep the default settings. Every app uses WireGuard first, the fastest protocol. Change a setting only when the VPN does not connect, usually on a network that blocks VPNs.
If a network blocks the VPN
Try these in order and connect again after each change.
- Stealth (WSS). It hides the VPN inside a normal secure web connection on port 443. It is a little slower.
- Windows: Settings > Connection > Prefer WSS connections
- Mac: Settings > Stealth Mode (WSS). It works only on supported servers and needs Use WireGuard turned on.
- Android: Settings > Prefer WSS
- TCP (Windows). Turn on Settings > Connection > Prefer TCP connections. The app also tries TCP on its own when the normal connection fails.
- Xray (Mac and Android). Xray is a second protocol that the Mac and Android apps use when WireGuard fails. To use only Xray, turn off Use WireGuard on Mac (Macs with Apple silicon only) or Use WireGuard (recommended) on Android.
- Legacy Mode (Windows). A last option for Premium users on 64-bit Windows. It needs a one-time download and does not carry UDP traffic, so games and calls may not work. It cannot be on at the same time as Lockdown mode.
The iPhone and iPad app uses WireGuard only. The browser extension is a proxy for your browser and has no protocol setting.
Still blocked? See Hide My IP does not connect and Use Hide My IP where VPNs are blocked.