VPN Overhead
Calculate the effective throughput loss caused by VPN tunneling and encryption overhead.
About VPN Overhead
Every VPN protocol wraps the original payload in extra headers for encapsulation, encryption, and authentication, and that added header consumes link capacity without carrying user data. The overhead percentage is the VPN header size divided by the total on-wire packet size (payload + header). IPsec (ESP in tunnel mode) typically adds 50-100 bytes depending on the cipher and authentication algorithm; OpenVPN adds 28-48 bytes depending on cipher and whether TCP or UDP is used; WireGuard has a fixed, minimal 32-byte overhead by design.
Formulas
VPN overhead percentage
overhead% = vpn_header / (payload + vpn_header) × 100
- h
- VPN header/trailer size in bytes
- p
- Original payload size in bytes
Effective throughput
effective_throughput = link_bandwidth × (payload / (payload + vpn_header))
- B
- Underlying link bandwidth
Worked example
With the default values below, VPN Overhead returns Overhead of 2.23%. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Payload Size (per packet)minimum 1 bytes
- 1,400 bytes
- VPN Protocolone of IPsec (ESP, tunnel mode) — 73 bytes, OpenVPN (UDP) — 38 bytes, WireGuard — 32 bytes
- WireGuard — 32 bytes
- Underlying Link Bandwidthminimum 0.01 Mbps
- 100 Mbps
Results
- Overhead
- 2.23%
- Effective Throughput
- 97.765 Mbps
- Throughput Lost to Overhead
- 2.235 Mbps
- VPN Header Size
- 32 bytes
- Total Packet Size on Wire
- 1,432 bytes
Step by step
- 1Values used
- 2VPN overhead percentage
- 3Effective throughput
- 4Overhead= 2.23
- 5Effective Throughput= 97.765 Mbps
- 6Throughput Lost to Overhead= 2.235 Mbps
- 7VPN Header Size= 32 bytes
- 8Total Packet Size on Wire= 1,432 bytes
Assumptions and limits
- The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax or compounding frequency into account.
- Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Which VPN protocol has the lowest overhead?
WireGuard has the lowest and most predictable overhead at a fixed 32 bytes per packet, since it uses a single modern cipher suite (ChaCha20-Poly1305) with a minimal, fixed-size header — no negotiable options to add extra bytes.
Why does IPsec overhead vary so much (50-100 bytes)?
IPsec's ESP overhead depends on the chosen encryption cipher and block size (padding to the cipher's block boundary), the authentication algorithm (HMAC-SHA256 vs SHA1), and whether NAT-Traversal (UDP encapsulation) is in use, all of which add variable bytes.
Does smaller payload size make overhead worse?
Yes — the VPN header is a fixed number of bytes regardless of payload size, so it represents a larger percentage of a small packet than a large one. This is why VPN throughput loss is more noticeable with lots of small packets (e.g. VoIP) than with large file transfers.
Is throughput loss the only cost of a VPN?
No — VPNs also add CPU overhead for encryption/decryption and can add latency from the encapsulation process itself, though on modern hardware with AES-NI or ChaCha20 acceleration, throughput overhead from header bytes is usually the dominant, measurable cost.