ClownVPN ships WireGuard and OpenVPN. Both peer-reviewed, both currently recommended. We deliberately skip everything else.
🤖 Get The Free AppFast. Modern. Default.
Compatible. Battle-tested. Fallback.
| Spec | ⚡ WireGuard | 🛡️ OpenVPN |
|---|---|---|
| Released | 2015 | 2001 |
| Lines of code (core) | ~4,000 | ~70,000+ |
| Speed (typical) | Excellent (near line-rate) | Good (slightly slower) |
| Battery use on mobile | Very low | Moderate |
| Default cipher | ChaCha20-Poly1305 | AES-256-GCM |
| Default transport | UDP only | UDP or TCP |
| Handshake time | ~50ms (1-RTT) | ~200ms+ (multi-RTT TLS) |
| Works behind strict firewalls | UDP blocking can hurt | Yes (TCP/443) |
| Audit status | Multiple academic audits | Long deployment history |
| ClownVPN role | Default | Fallback |
Tiny codebase. Modern ciphers (ChaCha20, Curve25519, BLAKE2s). Designed in the 2010s for current network conditions. Best mobile battery profile.
Two decades of deployment hardening. Can run over TCP/443 which makes it look like normal HTTPS traffic — gets through restrictive networks where WireGuard's UDP gets dropped.
Three or four protocols looks comprehensive but means more attack surface, more bugs, more cost to keep current. We'd rather maintain two well than five poorly.
| Protocol | Why we skip it |
|---|---|
| PPTP | Broken since 2012. Authentication is bruteforceable in hours. |
| L2TP/IPsec | Slow handshake, complex config, IPsec implementation footguns. |
| IKEv2 | Fine technically, but adds maintenance burden without meaningful benefit over WireGuard for our use case. |
| SSTP | Microsoft-proprietary, Windows-centric, not widely peer-reviewed. |
| SoftEther | Multi-protocol Frankenstein. Powerful but the wrong tool for a consumer app. |
| Shadowsocks | Designed for censorship circumvention, not general-purpose VPN. Different problem space. |
Default mode is "Auto". Here's what happens when you tap Connect:
Open UDP socket to port 51820. Send handshake. If we get a reply within 1 second, we're connected. Done.
Some networks block port 51820 but allow other UDP traffic. Try OpenVPN on UDP/1194.
Strict corporate / school networks often only allow TCP/443 (HTTPS). OpenVPN over TCP/443 looks like regular HTTPS to a firewall and almost always gets through.
Both shipping in the free Android app. Auto-select on by default.
🤖 Get It On Google Play