In 2015 a developer named Jason Donenfeld started rewriting how virtual private networks work. He was not a corporate research team or a standards committee. He was one person, known online as zx2c4, and WireGuard was influenced by his earlier low-level kernel work, including a rootkit he had written. Building stealthy code taught him what quiet, hard to detect networking should look like. Everything he saw in the existing VPN world looked like the opposite.
The tools people relied on were OpenVPN and IPsec. Both worked, and both were a nightmare. OpenVPN leaned on the enormous OpenSSL library, and together that stack ran to hundreds of thousands of lines of code. IPsec was a sprawl of overlapping standards, daemons, and configuration that almost nobody could hold in their head. Complexity like that is not just annoying. It hides bugs, invites misconfiguration, and makes real security review impossible. Few people can realistically audit half a million lines and honestly claim to understand what they do.
Donenfeld's answer was WireGuard, and its defining number is the size. The Linux kernel implementation fits in under 4,000 lines of code. A competent engineer can read all of it in an afternoon and actually reason about how it behaves. That was the point. Small code is code people can review, which means flaws get found instead of shipped. Linus Torvalds skimmed it and told the Linux kernel mailing list that compared to the horrors that are OpenVPN and IPSec, it was a work of art. That is not language Torvalds hands out often.
The design underneath is as disciplined as the code count. WireGuard uses Curve25519 for key exchange, ChaCha20 for encryption, Poly1305 for authentication, BLAKE2s for hashing, and the Noise protocol framework for its handshake. These are modern, fast, well studied cryptographic primitives. Donenfeld also made a choice most protocols avoid. There is no cipher agility. You cannot negotiate which algorithms to use, because negotiation is exactly where older protocols get tricked into downgrading to something weak. WireGuard picks strong cryptography and refuses to argue about it. If the primitives ever need replacing, the version changes and everyone moves together.
How it behaves on the wire matters just as much for anyone trying to stay unseen. A WireGuard server does not respond to packets it cannot authenticate. To a random scanner sweeping the internet, a properly configured endpoint appears indistinguishable from an unused UDP port. There is no banner, no handshake, no proof the port is even open. Peers are identified by their public keys rather than their IP addresses, so a phone can move from wifi to cellular and back without having to renegotiate the tunnel. Less noise, less to fingerprint, less to track.
The wider world caught up fast. WireGuard was merged into the mainline Linux kernel and shipped in Linux 5.6 in March 2020, putting it inside the operating system that underpins much of the internet. It now has implementations on Windows, macOS, iOS, Android, and the BSDs. It is free and open source under the GPL. Many commercial VPN providers adopted WireGuard alongside or in place of their older protocols, because once something this clean exists, defending the old bloat becomes indefensible. One developer set the standard and much of the industry followed.
Donenfeld proved something Blackout takes seriously. Real security comes from having less to trust. Every line of code is a place a mistake can hide, and every configuration knob is a chance to get it wrong. A protocol you can read is a protocol you can verify, and verification is the only honest basis for trust.
That is why Blackout runs WireGuard and nothing else. We do not offer a menu of aging protocols so a settings page looks busy. We use the one that is small enough to audit, disciplined enough to trust, and quiet enough to reduce what you expose every time you connect. Jason Donenfeld built the tool that made that possible, and he handed it to everyone for free. That earns a place in the Hall of Fame.
Blackout VPN exists because privacy is a right. Your first name is too much information for us.
Keep learning
FAQ
Who created WireGuard?
Jason Donenfeld, a security researcher known online as zx2c4. He originated the design and wrote the initial implementation starting around 2015, with later contributions from others across its various platform implementations.
Why is WireGuard considered more secure than OpenVPN?
It uses modern fixed cryptography, and its Linux kernel implementation fits in under 4,000 lines of code, so it can actually be audited. The OpenVPN and OpenSSL stack runs to hundreds of thousands of lines that few people can fully review.
Is WireGuard free to use?
Yes. WireGuard is free and open source, released under the GPL, and it is built into the Linux kernel as of version 5.6 in March 2020.
Does WireGuard hide that a server is even there?
A WireGuard endpoint stays silent to any packet it cannot authenticate. To an unauthenticated scanner the server looks closed, which reduces what an attacker can see and probe.
Why does Blackout use WireGuard exclusively?
Its small auditable codebase and modern cryptography mean less to trust and less to expose. Offering older protocols would only add attack surface without adding real security.