AmneziaWG vs WireGuard: what is the difference, and which file to download

AmneziaWG vs WireGuard — which to choose? In practice, it is the same VPN protocol, and there is exactly one difference: AmneziaWG disguises the traffic, so carrier filters do not recognize it. NvoVPN runs on AmneziaWG by default, and your account issues the configuration file in both formats. Below is how to choose and what to download in four steps, a table of differences, and answers about compatibility, speed and routers. If you are in Russia, be sure to read the "Are you in Russia?" block.

1. 1

   Get the difference in one sentence

   AmneziaWG is the same WireGuard, but its packets are disguised on the outside. The encryption, keys and speed are the same, and carrier equipment (DPI — deep packet inspection) does not see a VPN in them and does not throttle them.

2. 2

   Get the file from your account

   Open your account → "Connection" → "Manual". Choose a server, name the device and click "Create". A .conf file for AmneziaWG appears, with a plain WireGuard variant next to it, plus a QR code and text. One file, one device.

3. 3

   Pick the variant for your device

   Phone and computer — the NvoVPN app, which already runs on AmneziaWG. A router or client that supports AmneziaWG — the AmneziaWG file. A router or client that only understands WireGuard — the WireGuard variant, which works where VPNs are not blocked. In Russia, and everywhere VPNs are throttled, only AmneziaWG will do.

4. 4

   Check that the VPN is working

   Connect and open the "What is my IP" page. It should show the NvoVPN server's address, not your provider's. The address did not change — the connection did not come up: on a network with blocks, replace the WireGuard variant with the AmneziaWG file.

In short: a table of the differences

What WireGuard is, and why it is visible

WireGuard appeared as an answer to heavyweight OpenVPN and IPsec: about four thousand lines of code against hundreds of thousands, modern cryptography with no cipher choices, and it has been built into the Linux kernel since version 5.6 (2020). It runs only over UDP, a connection comes up in a single handshake, and switching between Wi-Fi and mobile data goes unnoticed. That is why most VPN services moved to it.

Simplicity has a price. The authors state plainly that WireGuard does not handle obfuscation — that "should happen at a layer above". Every handshake packet has a fixed size (148 bytes for the request, 92 bytes for the reply) and fixed leading bytes. DPI equipment recognizes that sequence instantly — and on many networks simply does not let it through.

What AmneziaWG adds

AmneziaWG is an open-source fork of WireGuard by the Amnezia team. The cryptographic core was not touched: the keys, ciphers and Noise handshake are the same. What changed is how the packets look from the outside. In the configuration, this is a few parameters:

• Jc, Jmin, Jmax — before the handshake, the client sends Jc "junk" packets of random length between Jmin and Jmax. The telltale "148 → 92" pattern disappears.
• S1–S4 — a random prefix is added to the service packets (request, reply, cookie, data): their size stops matching the reference.
• H1–H4 — the standard WireGuard message-type numbers are replaced with custom ones, so the filter finds no familiar headers.
• Newer versions of the protocol added decoy packets that imitate other protocols, plus protection against statistical analysis. The NvoVPN app uses the current version and fills in the parameters itself.

The result: to DPI, the stream looks like nameless UDP traffic with no signatures. Where plain WireGuard does not connect at all, AmneziaWG gets through. If the filter is more aggressive and cuts any unfamiliar UDP, the NvoVPN app switches to VLESS/Reality stealth mode.

Compatibility, speed and battery

An AmneziaWG client with zero obfuscation parameters is fully compatible with a plain WireGuard server — and the other way around. But as soon as the parameters are on, the two sides stop understanding each other's packets: an AmneziaWG client will not connect to a plain WireGuard server, and a WireGuard client will not connect to an AmneziaWG server. That is why every configuration in your account comes in two variants. You cannot mix them, but you can use both on different devices.

Junk packets are only sent while the connection is being set up, and padding adds tens of bytes to packets. By independent measurements, the difference from "clean" WireGuard is a few percent; the theoretical maximum overhead from padding is around a tenth. You cannot notice it on a phone or laptop; battery use is the same as WireGuard's.

What to choose in NvoVPN

• Phone, computer — the NvoVPN app: AmneziaWG with an automatic switch to stealth mode, nothing to choose.
• Keenetic, OpenWrt, GL.iNet routers — the AmneziaWG file from your account, as in "VPN on a router" and "VPN on Keenetic".
• ASUS, MikroTik, TP-Link and other WireGuard-only clients — the WireGuard variant of the same configuration. Works where the protocol is not throttled: ASUS, MikroTik, TP-Link.
• Linux — amneziawg-tools, as in the Linux guide; plain wireguard-tools only on unfiltered networks.

FAQ

Is AmneziaWG less secure because something was added to it? No. The additions only concern how the packets look; the encryption and key exchange are the original WireGuard.

Can AmneziaWG be recognized and blocked? No protocol comes with a full guarantee: filters learn, and developers answer with new versions. In practice, AmneziaWG gets through where WireGuard is blocked; for the toughest case there is stealth mode.

Why is there no "WireGuard or AmneziaWG" choice in the app? Because AmneziaWG is no worse in any way, and on filtered networks it is the only option that works. The choice is only needed for routers and third-party clients, and it is available in your account.

Where can I download an AmneziaWG client? For phone and computer, the NvoVPN app already has AmneziaWG inside. Separate clients for Windows, macOS, Android, iOS and Linux are published by the Amnezia team on GitHub — the AmneziaWG file from your account works with them.

Can AmneziaWG go on a router? Yes — on Keenetic (KeeneticOS 4.3.4 and later), OpenWrt with the amneziawg packages, and GL.iNet. Details in the router guide.

Related guides: Why VPNs stop working and how stealth mode works · How to set up a VPN on a router · How to set up a VPN on Linux