In short: AmneziaWG is WireGuard with masking. Inside it is the same cryptography and the same speed as ordinary WireGuard, but the connection is masked so that it is harder to recognise on the network - which is why AmneziaWG holds where ordinary WireGuard comes up and goes quiet a minute later. Below: how it works in plain words, what exactly differs, where to download it and how to set it up, and what to do if your client will not accept an AmneziaWG configuration.
What AmneziaWG is, in plain words
WireGuard is a fast, frugal protocol, and that is what people love it for. But it has a weak spot: its traffic looks distinctive - the connection has a recognisable “pattern” (a fixed handshake format, predictable packet sizes). When a network is fussy about traffic like that, it recognises the pattern and cuts the connection - WireGuard either will not connect, or comes up and goes quiet a minute later.
AmneziaWG solves this without changing what WireGuard essentially is. It adds masking: the connection stops being recognisable, and the network lets it through as ordinary traffic. The cryptography, the speed, the frugal battery use - everything from WireGuard stays; the only thing that changes is how the connection looks from the outside.
The main idea in one line: it is not “slow, secure WireGuard” but “invisible WireGuard” - the same speed, only harder to recognise.
How AmneziaWG differs from WireGuard
The difference is a handful of masking parameters added to an ordinary WireGuard configuration:
- Jc, Jmin, Jmax - the number and size of “junk” packets sent before the handshake. They throw off recognition: the connection stops beginning in the distinctive way.
- S1, S2 - the amount of random data added to the handshake packets so that their sizes are not predictable.
- H1, H2, H3, H4 - header constants replacing WireGuard’s standard values: it is precisely by the standard headers that ordinary WireGuard is identified.
The speed stays close to WireGuard: early versions masked only the beginning of the connection, while recent ones (3.1, released in the summer of 2026 as an answer to networks getting stricter) mask the data transfer as well - the junk packets cost a small amount of speed, usually unnoticeable in practice. The practical conclusion: if the network has started cutting WireGuard, AmneziaWG usually solves it, and the speed you lose is incomparably less than a connection that does not work at all.
When to choose AmneziaWG
An honest guide rather than “always turn this on”:
- Ordinary WireGuard has stopped connecting on your network (often on mobile data) - this is AmneziaWG’s main case.
- You want a fast protocol for everyday use - AmneziaWG keeps WireGuard’s speed, so it works as your main one.
- The connection is unstable and drops where it used to work - masking helps get through a network that has become stricter.
And if the network filters especially hard and even AmneziaWG is unstable, then it is the turn of protocols that mask traffic as an ordinary visit to a website: VLESS + Reality. How VLESS differs and when it is steadier - what VLESS and Reality are, covered separately. Not a “better or worse” ranking but different tools: in some places AmneziaWG is faster, in others VLESS is steadier.
AmneziaWG, WireGuard and VLESS: which when
| WireGuard | AmneziaWG | VLESS + Reality | |
|---|---|---|---|
| Speed | Highest | Close to WireGuard | High |
| Masking | None - easily recognised | Yes (WireGuard with masking) | Yes - looks like a visit to an ordinary site |
| When to take it | The network does not interfere with a VPN | WireGuard has stopped getting through | The network filters especially hard |
| Where it lives | Almost any client and router | An awg-compatible client, some routers | Clients such as Happ, INCY |
A simple rule: start with AmneziaWG (fast, and it gets through where WireGuard gave up); if that is not steady enough, move to VLESS+Reality. At Tainet both are in one subscription, and switching happens inside the app.
Where to download AmneziaWG and how to set it up
It helps to understand the structure: AmneziaWG is a protocol, not a single app. To use it you need two things - a client that speaks AmneziaWG, and a configuration (a .conf file) from a VPN service.
The client. AmneziaWG is understood by the AmneziaVPN app and by awg-compatible clients. An ordinary WireGuard client will as a rule not accept an AmneziaWG config - it reads only the basic fields and trips over the masking lines (Jc, S1, H1…). This is the key point behind most cases of “it does not work”: the file is being fed to WireGuard when it needs a client with AmneziaWG support.
The configuration. The .conf file comes from the VPN service. At Tainet the AmneziaWG configuration is issued on request in your account - by a separate button in the subscription section, not in the general list of keys: so if you are looking for it among the usual subscription links and cannot find it, it is not there, you need to request it with the button. From there the file is imported into an awg-compatible client, or into a router that speaks AmneziaWG.
To take out a subscription and get access to the configurations - in the Telegram bot or in your account, the first 7 days free.
AmneziaWG and VLESS in one subscription
No need to run your own server or hand-tune masking parameters - Tainet's ready-made configurations are set up for our servers. One protocol stops getting through, you switch to the other right inside the app. The first 7 days are free, then from $0.10 a day, covering phone, computer and TV on one subscription.
AmneziaWG on a router
A strength of its own: an AmneziaWG-compatible configuration can be installed on a router, and then the whole house gets a steady connection without setting up each device. On Keenetic routers the file is imported into the WireGuard section (that is the right place for it); on ASUS, through the Merlin firmware with an add-on. Detailed breakdowns by brand are in the hub on setting up a VPN on a router, and the specifics for ASUS with the masking lines are in the ASUS guide.
How to connect AmneziaWG on your device
Not the steps again, but where to go - the config is one, the app depends on the device:
- Phone and computer - it goes into an awg-compatible client; how to add a subscription in each is in the overview of VPN clients, and for particular apps see setting up Happ and setting up INCY.
- Router - the AmneziaWG config installs on Keenetic (imported into the WireGuard section) and ASUS (through Merlin with an add-on); the breakdowns by brand are in which router will do and how to set it up.
If the client will not accept the configuration
The most common complaint, and the cause is almost always the same: the config has been opened in the wrong client. Check in order:
- Does the client speak AmneziaWG? Ordinary WireGuard will not open it - you need AmneziaVPN or another awg-compatible client. In the app’s “Protocol” section it must say “AmneziaWG”, not “WireGuard”.
- Is the file intact and unedited? The masking lines (Jc, Jmin, Jmax, S1, S2, H1–H4) must be present - without them what remains is ordinary WireGuard, the very thing AmneziaWG exists to move away from. They must not be deleted. And importantly: do not change their values by hand - these parameters have to match the server byte for byte, or the handshake will not go through and there will be no connection. The file from the service is already tuned to its servers; twiddling Jc and H1 “to see what happens” is a sure way to break a working configuration.
- Encoding. If you edited the file by hand, save it as UTF-8 without BOM: the invisible mark at the start stops the client reading the configuration.
If after this the connection comes up but no data flows, change the server or the country in the configuration; a common cause of “it connects but stays silent” is one particular overloaded server.
Frequently asked questions
Is AmneziaWG faster than ordinary WireGuard?
The speed is close to WireGuard, with a small trade-off: the junk packets and the masked data transfer (in version 3.1) slow the connection very slightly, though in practice that is usually unnoticeable. AmneziaWG’s gain is not in speed but in getting through where ordinary WireGuard stops connecting - and something working slowly always beats something not working quickly.
Are AmneziaWG and WireGuard different protocols?
AmneziaWG is a modification of WireGuard, not a separate brand. The cryptography is the same (ChaCha20, Poly1305, Curve25519); only masking has been added. Because of it, an ordinary WireGuard client usually will not open an AmneziaWG config.
Why has ordinary WireGuard stopped connecting while AmneziaWG works?
WireGuard has a recognisable network “pattern”, and when a network starts being fussy about traffic like that, it cuts it. AmneziaWG masks that pattern, and the connection goes through as ordinary traffic.
AmneziaWG or VLESS - which to choose?
AmneziaWG is the fast default, the one to try first. VLESS+Reality is for when the network is stricter and WireGuard-like connections are unstable. These are different tools for different conditions rather than a ranking; the VPN protocol comparison: VLESS, Shadowsocks and Hysteria2 is separate.
Do I need a separate client for AmneziaWG?
You need a client with AmneziaWG support (AmneziaVPN or another awg-compatible one), or a router that speaks it. An ordinary WireGuard app is not enough.
In summary
In short: AmneziaWG is WireGuard at WireGuard’s speed, masked so that it gets through where the ordinary one has stopped connecting. You need a client that supports it and a configuration from a service - at Tainet it comes in one subscription together with VLESS+Reality, issued on request in your account, the first 7 days free: enough to check on your own network which protocol holds up better. Questions go to support, where real people answer.
