AmneziaVPN launches AmneziaWG 2.0 – and it's a 'fundamental shift' from its predecessor

AmneziaVPN has developed a new and updated version of its obfuscating VPN protocol – AmneziaWG 2.0.

The open-source protocol is designed to bypass internet restrictions, and AmneziaVPN said the new version has been developed "as a response to advanced internet censorship."

AmneziaVPN can't match the best VPNs for features, but obfuscation and privacy is what it does best. AmneziaWG is open-source and can be "quickly integrated" and adopted by other VPNs – for example, Windscribe and NymVPN are confirmed to use the protocol.

Version 2.0 represents "a fundamental shift" in how AmneziaWG works, and aims to "keep the gates to the global internet open for millions of people."

AmneziaVPN | $4 per month | 1 Year
AmneziaVPN isn't packed full of features, but it specializes in obfuscation and bypassing censorship. The AmneziaWG protocol is fast, secure, and open-source, plus freely available to download and use.

A one-year deal costs $4 per month ($48 upfront) and comes with a 7-day money-back guarantee. There's also a free plan offered in certain regions around the world.

View Deal

Why was a new version needed?

Internet censorship affected 4.6 billion people in 2025, and governments are becoming increasingly skilled at detecting VPN traffic bypassing their restrictions.

Deep-packet inspection (DPI) is one of the most commonly used methods of traffic detection. Traffic, and its data packets, is anlayzed. With no obfuscation, VPN traffic stands out from regular internet traffic and can be easily detected and blocked.

Previously used obfuscation methods – for example, using random bytes to "mislead" DPI – are no longer as effective. AmneziaVPN said "Cloak, Obfs4, Shadowsocks, and AmneziaWG 1.0 no longer work in countries where governments actively enforce internet censorship." As a result, a new version was required.

AmneziaWG 2.0 "becomes indistinguishable" from regular internet traffic through the use of Signature Packets, a Custom Protocol Signature, Advanced Padding, and Ranged Headers.

According to AmneziaVPN, the "mechanisms work step by step." Packets that appear as regular internet traffic are sent initially. Once network filtering systems have been bypassed, the headers and packet sizes are changed "to maintain the disguise throughout the session."

"The requirements for VPN services are changing – censorship technologies may be slower than us, but they are developing," said Mazay Banzaev, founder of Amnezia.

But AmneziaVPN aims "to stay ahead of the curve," by modifying its existing protocol. Banzaev said: "In the second version, we kept some of the solutions from our first protocol, but modified them to make the connection indistinguishable from legitimate UDP-based traffic: a DNS request, a QUIC session, or a SIP call."

Who can use AmneziaWG 2.0?

As mentioned, AmneziaWG is fully audited, and open-source. It can be inspected by anyone, and adopted by any VPN, as well as router manufacturers. Banzae shared that AmneziaWG has "gone beyond" its own platform, with VPNs integrating it and "strong interest from large companies."

You can also use AmneziaWG to run your own VPN on a personal server (VPS). This can be used by individuals and businesses working and living under internet censorship.

Users will need to update their Amnezia app to version 4.8.12.9 to receive the AmneziaWG 2.0.

For now, it can only be used on your self-hosted VPN. AmneziaVPN Premium and AmneziaVPN Free will still run AmneziaWG 1.5, which is still effective at bypassing censorship. Version 2.0 will come to the apps "soon," so users should keep an eye out for updates.

The protocol can be viewed on AmneziaVPN's GitHub.

How AmneziaWG 2.0 works

AmneziaWG is a "fork" of the WireGuard protocol. It takes WireGuard's simple architecture and high performance, and builds on it. The protocol is "multi-layered" and AmneziaVPN detailed the obfuscation methods used:

Signature Packets

AmneziaVPN described this feature as "the most significant innovation in AmneziaWG 2.0."

At the start of your session, up to five packets – that closely mimic regular traffic – are sent. This limitation is enough for filters to "approve" the connection. Once this occurs, the VPN sends the real, obfuscated connection.

Custom Protocol Signature

Here, the structure and composition of packets is defined. Authorized packets must contain certain features, including "random parts and static data."

AmneziaWG 2.0 adds elements typical of these authorized features, with the DPI system essentially "tricked" into letting the data pass through.

Advanced Padding

Advanced Padding modifies the packet sizes. Random bytes are added to every packet, preventing VPN traffic from being distinguished by its distinctive size patterns.

AmneziaWG 1.0 only added bytes to "some packets," with others remaining predictable in size. In version 2.0, bytes are added to every packet.

Ranged Headers

Each packet is assigned a "random header number." Standard WireGuard uses "fixed identifiers," which AmneziaVPN said can be "easily detected by DPI." In version 1.0, these were replaced with one custom header number.

AmneziaVPN said "all packets had a static name and DPI systems learned to detect this repetition." It added that in AmneziaWG 2.0, "identifiers are randomly selected for each packet from a wide range, making it impossible to identify traffic patterns."

One-year and six-month AmneziaVPN plans are offered, costing $4 per month and $4.66 per month respectively.

There is also a free version, but its availability is limited to certain regions: Africa, Brazil, Cuba, India, Myanmar, Nepal, Pakistan, Russia, Turkey, Venezuela, Vietnam, and the UK.

AmneziaVPN also offers a six-month subscription at 50% if you're switching from a VPN you've already paid for.