WireGuard: a modern, minimal encrypted tunnel
The TP VPN apps for iOS and Android use a single tunnel protocol: WireGuard. It is built on modern cryptography, with a small codebase, fast handshakes and low battery use.
A handshake based on the Noise framework
WireGuard uses the IK handshake pattern of the Noise protocol framework, with Curve25519 key exchange, ChaCha20-Poly1305 authenticated encryption and BLAKE2s hashing. The handshake usually completes in a single round trip, and session keys are rotated automatically for forward secrecy.
A small codebase
The core WireGuard implementation is only a few thousand lines of code, far smaller than traditional VPN protocols. A smaller attack surface is easier to audit and has fewer defects, which is one reason it was merged into the mainline Linux kernel.
Kernel forwarding and low power use
Our server nodes encrypt, decrypt and forward packets inside the Linux kernel, avoiding repeated copies between user space and the kernel. On mobile the cryptography is lightweight, there is no complex session state to maintain, and the tunnel survives a switch from Wi-Fi to cellular in place, which is easy on the battery.
Key pairs are generated on your device
When a device is registered for the first time, the app generates a Curve25519 key pair locally. The private key is written only to the iOS Keychain or the Android Keystore; the server stores only the public key. Removing a device revokes its public key immediately and the tunnel stops working.
WireGuard only
We do not maintain several protocols side by side in the app. Focusing on one widely audited protocol keeps configuration simple, behaviour predictable and the scope of any security assessment clear. Tunnel configuration is delivered by the app automatically; nothing has to be imported by hand.
Protocol parameters
These parameters are fixed by the WireGuard protocol and are not configurable.
| Protocol parameters | WireGuard |
|---|---|
| Handshake | Noise_IK (one round trip) |
| Key exchange | Curve25519 |
| Symmetric cipher | ChaCha20-Poly1305 |
| Hash | BLAKE2s |
| Transport | UDP |
| Client requirements | iOS 17.0+ · Android 8.0+ (API 26) |
Key points
- Fast handshakes: usually one round trip, with quick recovery after a network change
- Small codebase: a few thousand lines at its core, merged into the mainline Linux kernel
- Low power use: lightweight cryptography suited to mobile devices that stay connected for hours
- The private key never leaves your device: Keychain or Keystore only, and the server keeps just the public key
- Session keys are rotated regularly for forward secrecy
- One protocol in the app, so behaviour is predictable
Plan availability
Every plan uses the same WireGuard network; there are no protocol or speed tiers.
Frequently asked questions
More answers in the Support Center, or email us directly.
Which protocols does TP VPN support?
The app currently supports WireGuard only. Tunnel configuration is delivered automatically by the app; there is nothing to import or configure by hand.
Does WireGuard record my IP address?
The WireGuard protocol needs to hold the peer address briefly in server memory to keep the tunnel alive. TP VPN does not write it to the database, log files or backups. See the No activity logs page for details.
Why do I not have to sign in again after switching networks?
WireGuard identifies peers by public key rather than IP address, so the tunnel resumes in place when you move from Wi-Fi to cellular. If the tunnel does drop, the app reconnects automatically with exponential backoff.
Does WireGuard drain the battery?
No. The cryptography is relatively lightweight and the protocol keeps no complex session state; actual power use depends mainly on how much traffic you send.
More features
Every feature listed here ships in the iOS and Android apps today.
No activity logs
No browsing content, DNS queries or traffic destinations. Those fields do not exist in our database schema, and the build pipeline asserts it.
Learn moreSmart routing
A weighted score across latency, load and packet loss picks the best node. Exponential-backoff reconnection when a tunnel drops, or choose by scene, country, favourites and recents yourself.
Learn moreSeveral devices at once
Use one account on several devices simultaneously: 2, 4, 8 or 50 depending on your plan. Remove or migrate devices yourself in the app.
Learn moreFair Use Policy
No fixed data quota, only a fair-use threshold. Beyond it, speed is reduced rather than the connection cut, and it resets with the next billing period.
Learn moreSee how fast WireGuard connects
Built into the iOS and Android apps; download and connect with one tap.