VPN Throughput Explained: What Speeds to Expect

What is VPN throughput?

VPN throughput is the amount of data a router can move through a VPN tunnel in a given time. It is a processing limit, not a radio limit. A Wi-Fi speed rating tells you how fast the router can talk to your phone or laptop; VPN throughput tells you how fast the router can encrypt and decrypt data before it leaves or after it arrives.

The underlying Wi-Fi technology is defined by the IEEE 802.11 standard, which describes the medium access control and physical layer specifications for wireless LANs. Those specifications set the radio link's potential, but they do not describe encryption work. That is why a router with a fast Wi-Fi rating can still have modest VPN throughput.

When you read a spec sheet, check which number is being quoted. If it is a Wi-Fi data rate, it belongs to the radio link. If it is a VPN throughput number, it belongs to the router's processor. Both matter, but they answer different questions. For a router VPN you need the second number.

Why router speeds drop when a VPN is active

A router without a VPN mostly forwards packets. A router with a VPN client must encrypt every outgoing packet and decrypt every incoming packet. That work is done by the processor, and the same processor also handles routing, firewall inspection, Quality of Service, and the Wi-Fi radios. When the processor is busy with encryption, the maximum throughput falls.

The size of the drop depends on the VPN protocol and the encryption settings. Protocols that use modern cryptography and simpler operations generally put less load on the processor, while older protocols with heavier negotiation can consume more processor time. The difference between OpenVPN and WireGuard on routers is a good example of why protocol choice matters.

Routers with hardware acceleration can reduce the drop by offloading the encryption math from the main CPU. Even so, VPN throughput tends to be lower than the router's normal routing speed because encryption is always extra work. If the router's VPN throughput is lower than your Internet plan, the encrypted connection will cap the speed you actually get. For that reason, the router's CPU and RAM are more relevant to VPN speed than the Wi-Fi generation.

Which specs to compare when choosing a router for VPN

Compare three things before you buy: VPN protocol support, processor class, and hardware acceleration. Protocol support matters because a modern low-overhead protocol can deliver more throughput on the same processor. Processor class matters because encryption scales with computing power. Hardware acceleration matters because it can handle encryption without using the main CPU.

Do not use the Wi-Fi generation as a proxy for VPN throughput. The Wi-Fi Alliance describes Wi-Fi 7 as using features such as 320 MHz channels in the 6 GHz band that provide twice the throughput of Wi-Fi 6, but those numbers describe the wireless link, not the router's ability to encrypt and decrypt VPN traffic. A Wi-Fi 7 router can still have modest VPN throughput if its processor is not up to the task.

• Supported VPN protocols: more options, especially modern low-overhead ones, is better.
• Rated VPN throughput: a spec that states throughput per protocol is the most direct comparison.
• Processor and acceleration: the router chipset and any crypto engine usually set the VPN ceiling.
• RAM and connection tracking: enough RAM keeps many VPN sessions stable, even though RAM alone does not set the throughput limit.

VPN client, VPN server, and VPN passthrough are different

A VPN client on the router sends your whole home network through a VPN provider. That is the feature that matters for VPN throughput, because the router must encrypt and decrypt all traffic. A VPN server is the opposite: it accepts incoming VPN connections from devices outside your home. VPN passthrough is neither; it just allows VPN traffic from your devices to pass through the router to an external VPN provider.

For most buyers, the practical question is whether to use a router VPN or a device VPN. If only one laptop needs VPN, install a VPN app on that laptop and the router's throughput barely matters. If you want automatic protection for every device, including smart TVs and game consoles, the router VPN client becomes important, and VPN throughput is the spec that predicts how well it will work.

How to judge how much VPN throughput you need

Start with your Internet plan, then think about what will run through the tunnel. If your plan is modest, even a basic VPN router may be enough. If your plan is fast, the router's VPN throughput will set the ceiling, and a faster Wi-Fi router will not remove that ceiling.

Consider the heaviest activity on the network. Web browsing and messaging use little bandwidth. Streaming high-resolution video, large file transfers, and multiple simultaneous video calls use much more. Video calls also need consistent performance, because latency spikes are more noticeable than small speed differences. A practical rule of thumb is to choose a router whose VPN throughput is above what your heaviest use needs, leaving headroom for the processor to handle other tasks.

Finally, think about how many devices share the connection. One light user is very different from a household with several streams and calls at once. If the whole household depends on VPN, choose a higher-tier router with a faster processor and modern protocol support rather than a budget model sized for a single device.

How to check VPN throughput after you buy

After setup, run a speed test with the VPN off and then on using the same device and the same connection. The difference is a rough measure of the router's VPN throughput for that protocol. A wired test is the cleanest because it removes Wi-Fi variables; a Wi-Fi test shows the combined result you can expect on your devices.

Check the router's status page for processor usage while the VPN is active. If the CPU is constantly near its limit, the router is the bottleneck. Router firmware updates can also change VPN performance, because VPN implementations are often improved over time.

Security matters as much as speed

Higher throughput is useful, but the point of a VPN is protecting traffic. The Wi-Fi Alliance describes WPA3 as providing more robust authentication, increased cryptographic strength, and protection from password guessing attempts on Wi-Fi networks. WPA3 protects the wireless link; a VPN protects the encrypted tunnel to the VPN provider, and the two work together.

Federal guidance frames encryption as part of broader risk management. NIST develops cybersecurity and privacy standards and best practices, and its small business resources present risk management as the right frame for decisions like VPN use. When you compare routers, treat security features and VPN protocol support as part of the same decision. See the router security basics guide for the full picture.

What to pick for your use

Questions

What is VPN throughput?

VPN throughput is the rate at which a router can encrypt and decrypt traffic passing through a VPN tunnel. It is set by the processor, the VPN protocol, and any hardware acceleration, and it is normally lower than the router's raw routing speed.

Why is my router slower when the VPN is on?

Because the router must encrypt outgoing packets and decrypt incoming packets. That workload competes with routing, firewall, Quality of Service, and Wi-Fi tasks, so the maximum speed over the VPN falls. The drop is smaller with a modern low-overhead protocol and with hardware acceleration.

Is WireGuard faster than OpenVPN on routers?

WireGuard is a newer protocol designed with lower overhead, so on many routers it can deliver higher throughput than OpenVPN. The exact result depends on the router's processor and firmware. If the maker's spec sheet lists throughput per protocol, compare those numbers directly.

Do I need a VPN router if I only use VPN on one device?

No. If you install a VPN app on a single laptop or phone, the router's VPN throughput does not matter. A router VPN client is worth considering when you want every device, such as smart TVs and game consoles, to use the VPN automatically.

Does VPN throughput matter if my router supports VPN passthrough?

VPN passthrough does not encrypt traffic on the router; it only allows devices to connect to an external VPN. If the router is not creating the tunnel, its VPN throughput is not the limiting factor. Check whether the router has a VPN client before comparing throughput numbers.

How can I estimate a router's VPN speed before buying?

Look at the maker's spec page for supported VPN protocols, a rated VPN throughput number, and any mention of hardware acceleration. Treat the Wi-Fi speed rating as unrelated to VPN throughput, and pick a tier that matches your Internet plan and the number of heavy users.