WireGuard Throughput Calculator
Estimate WireGuard tunnel throughput from link rate, packet size and per-core crypto performance.
About WireGuard Throughput Calculator
WireGuard adds a fixed 60 bytes over IPv4 (80 over IPv6), so goodput is the payload fraction of the frame. Because ChaCha20-Poly1305 runs per packet on a single core per peer flow, the CPU ceiling — cores multiplied by per-core rate — often binds before the link does. Knowing which ceiling binds tells you whether to buy more bandwidth or more cores; on a 10G link a 4-core box will usually cap around 6 Gbps regardless of circuit size.
Formula
WireGuard Throughput
throughput = min(link rate × payload ÷ (payload + 60), cores × per-core crypto rate).
- 60
- WireGuard overhead: outer IPv4 20 + UDP 8 + WireGuard header 16 + Poly1305 tag 16
- efficiency
- Payload bytes divided by total wire bytes
Worked example
With the default values below, WireGuard Throughput Calculator returns Expected Throughput of 959.5. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Link rateaccepts 1–400,000 Mbps
- 1,000 Mbps
- Inner packet sizeaccepts 64–9,000 bytes
- 1,420 bytes
- CPU cores handling cryptoaccepts 1–256 cores
- 4 cores
- Crypto throughput per coreaccepts 0.05–20 Gbps
- 1.5 Gbps
- Outer IP versionone of IPv4 outer (60 B total), IPv6 outer (80 B total)
- IPv4 outer (60 B total)
Results
- Expected Throughput
- 959.5 Mbps
- Link-limited Goodput
- 959.5 Mbps
- Crypto Ceiling
- 6,000.0 Mbps
- Protocol Overhead
- 4.05%
- Packet Rate
- 81.0 kpps
- Limiting Factor
- Link rate bound
Step by step
- 1Values used
- 2WireGuard Throughput
- 3Expected Throughput= 959.5 Mbps
- 4Link-limited Goodput= 959.5 Mbps
- 5Crypto Ceiling= 6,000.0 Mbps
- 6Protocol Overhead= 4.05
- 7Packet Rate= 81.0 kpps
- 8Limiting Factor= Link rate bound
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is WireGuard Throughput calculated?
throughput = min(link rate × payload ÷ (payload + 60), cores × per-core crypto rate). WireGuard adds a fixed 60 bytes over IPv4 (80 over IPv6), so goodput is the payload fraction of the frame. Because ChaCha20-Poly1305 runs per packet on a single core per peer flow, the CPU ceiling — cores multiplied by per-core rate — often binds before the link does.
Why does WireGuard Throughput matter?
Knowing which ceiling binds tells you whether to buy more bandwidth or more cores; on a 10G link a 4-core box will usually cap around 6 Gbps regardless of circuit size.
What values do I need to enter?
This calculator takes 5 inputs: Link rate, Inner packet size, CPU cores handling crypto, Crypto throughput per core, Outer IP version. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.