Open the settings menu of any VPN app and you’ll probably spot “AES-256” or “ChaCha20” listed somewhere near the protocol options. Both are encryption ciphers, both are considered secure in 2026, and picking between them is rarely something you actually need to do. Here’s what each one is, how they differ, and why the “best” one depends on your device rather than the math behind it.
What is AES-256?
AES (Advanced Encryption Standard) is a block cipher: it takes your data, chops it into fixed-size chunks, and scrambles each one with a 256-bit key. It was selected by the US National Institute of Standards and Technology back in 2001 after a public competition, and it has since become the default encryption standard for governments, banks, and most software that needs to protect data at rest or in transit.
The reason AES-256 still holds up after two decades isn’t just the key length. Since the mid-2010s, most consumer and server CPUs (Intel, AMD, and even many ARM chips) have shipped with a dedicated instruction set called AES-NI, which handles AES calculations directly in hardware instead of software. On a modern laptop or desktop with AES-NI, encrypting and decrypting traffic barely registers as a performance cost. That’s why AES-256 tends to be the faster option on desktop and laptop hardware.
What is ChaCha20?
ChaCha20 works differently. It’s a stream cipher, meaning it generates a continuous stream of pseudo-random data and combines it with your traffic bit by bit, rather than working in fixed blocks. It was designed by cryptographer Daniel J. Bernstein, and it’s almost always paired with an authenticator called Poly1305, which checks that the data hasn’t been tampered with in transit. You’ll usually see the combination written as ChaCha20-Poly1305.
The advantage of ChaCha20 shows up on hardware that doesn’t have AES-NI acceleration, older phones, budget Android devices, some routers, and low-power IoT hardware. On that kind of hardware, AES has to run in software and slows down noticeably. ChaCha20 was built to run efficiently in software from the start, so it doesn’t need special hardware to stay fast. That’s the whole reason it exists: Bernstein designed it as a fast, constant-time alternative that performs well without hardware shortcuts.
It’s also the default cipher for WireGuard, the modern VPN protocol used by NordVPN (as part of NordLynx), ProtonVPN, Surfshark, and Mullvad, among others. If you want the deeper breakdown of how WireGuard compares to older protocols, we covered that in our VPN protocols guide.
AES-256 vs ChaCha20: quick comparison
| AES-256 | ChaCha20 | |
|---|---|---|
| Type | Block cipher | Stream cipher |
| Fastest on | Devices with AES-NI hardware acceleration (most modern desktops, laptops, recent phones) | Devices without AES-NI (older phones, low-power routers, some IoT hardware) |
| Common pairing | Used directly, or with GCM for authentication | Almost always paired with Poly1305 |
| Used by default in | OpenVPN, IKEv2/IPsec (most common configurations) | WireGuard |
| Standardized by | NIST (2001) | IETF (RFC 8439), designed by Daniel J. Bernstein |
| Known practical breaks | None | None |
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Is one actually more secure than the other?
No, and this is the part that trips people up. Both ciphers use 256-bit keys (in their standard VPN configurations), and neither has a known practical attack that would let someone decrypt your traffic in any reasonable amount of time, even with serious computing resources. Cryptographers have poked at both extensively since ChaCha20 was published in 2008 and AES was standardized in 2001, and both have held up.
The “AES-256 vs ChaCha20” framing you see in a lot of VPN marketing implies a security contest. There isn’t one. The actual difference is about performance profile, not strength. Asking which cipher is “stronger” is a bit like asking whether a wrench or a screwdriver is the better tool: it depends entirely on what you’re using it on.
Why does my VPN protocol determine my cipher?
Because the protocol dictates how encryption gets implemented. WireGuard’s spec hardcodes ChaCha20-Poly1305; that’s not configurable inside WireGuard itself, which is part of why the protocol is so lean and fast. OpenVPN and IKEv2/IPsec, on the other hand, are typically configured with AES-256-GCM by most VPN providers, though OpenVPN technically supports ChaCha20 as well if a provider chooses to enable it. So in practice, your cipher is less a setting you pick and more a consequence of which protocol you (or your app’s “Automatic” mode) selected.
What about the handshake and key exchange?
Encrypting your traffic is only half the picture. Before any of that scrambling happens, your device and the VPN server need to agree on a shared secret key without a third party being able to intercept it. That’s the handshake, and it typically relies on a different set of tools than AES or ChaCha20.
Most VPN connections lean on elliptic-curve Diffie-Hellman (ECDH) key exchange to establish that shared secret, sometimes backed by RSA certificates (commonly RSA-2048 or RSA-4096) to verify the server is who it claims to be. WireGuard uses Curve25519 for this step, a modern elliptic-curve method that’s fast and has a strong track record. You don’t need to memorize these names. The relevant point is that the handshake and the traffic encryption are two separate jobs, handled by different tools, and both need to be solid for the whole connection to be trustworthy.
Does the cipher choice actually matter for you?
Mostly, no. Almost every reputable VPN app defaults to whatever combination of protocol and cipher makes sense for your device automatically, and manually digging into cipher settings won’t meaningfully change your day-to-day privacy or security. What’s worth checking instead:
- Does the provider clearly state which cipher(s) it uses? Reputable providers list this in their apps or documentation. If you can’t find it anywhere, that’s a transparency problem worth noting.
- Is it AES-256 or ChaCha20 (with Poly1305)? Either is a solid, modern choice. You don’t need to pick between them.
- Has the provider’s encryption implementation been independently audited? A cipher is only as trustworthy as the code implementing it. We cover which providers can actually back up their claims in our audited no-logs VPN roundup.
If you spot something noticeably older listed as the only option, like Blowfish or a short 128-bit AES key with no way to upgrade it, that’s worth a closer look at the provider’s other security practices before committing. But for the vast majority of VPNs on the market in 2026, including every provider in our testing, this simply isn’t a real-world concern.
AES-256 and ChaCha20 are both secure, both current, and neither one is objectively "better" than the other. AES-256 tends to run faster on modern desktops and laptops thanks to hardware acceleration; ChaCha20 tends to run faster on older phones and low-power devices without it. Your VPN protocol picks the cipher for you in most cases, WireGuard uses ChaCha20, OpenVPN and IKEv2 usually use AES-256, so there's rarely a manual decision to make. Focus on whether your provider is transparent about its encryption and backs it up with an independent audit, not on which cipher name shows up in the settings menu.
NordVPN covers both bases well, offering ChaCha20 through its NordLynx (WireGuard-based) protocol and AES-256 through OpenVPN, backed by an independent PwC audit. If a fully audited no-logs policy matters more to you than protocol variety, ProtonVPN is one of the few providers with a KPMG-verified no-logs audit alongside strong AES-256 encryption throughout.