Does a VPN Work on 5G? What 5G Encrypts, What It Doesn't, and What the Numbers Say
Type "does VPN work with 5G" into a search engine and most answers waste your time, because the honest answer takes one sentence: yes, a VPN runs on 5G like on any internet connection, since the tunnel neither knows nor cares what radio carried its packets. The questions worth a page are the ones underneath: what does 5G already encrypt without any VPN, what does it leave exposed, and does tunneling cost you the speed you bought a 5G plan for. Those have precise, spec-sourced answers, and they are rarely the answers VPN marketing gives.
What does 5G already encrypt, and what does a VPN actually add?
5G's security design, written in 3GPP's TS 33.501, fixed the embarrassing parts of 4G and 2G. It also stops precisely at the carrier's edge. The table maps each layer: what the standard protects, what your operator still sees, and what changes when a VPN is on.
| Layer | What 5G itself protects | What the carrier still sees | What a VPN changes |
|---|---|---|---|
| Radio link (phone to base station) | Ciphered at the PDCP layer with modern algorithms (TS 33.501): over-the-air sniffing of content is defeated | Everything, because the encryption terminates at the carrier's own equipment | Nothing new over the air; the tunnel rides inside already-encrypted radio frames |
| Tamper protection of your data | Full-rate integrity supported since Release 16, but activation is operator policy per session; before Rel-16, phones only had to support it up to 64 kbps | n/a | The tunnel brings its own integrity protection regardless of operator policy |
| Your identity over the air | The permanent subscriber ID (SUPI) is never sent in clear; it travels as an encrypted SUCI only the home network can open | The carrier knows exactly who you are; it issued the SIM | Nothing; a VPN does not touch SIM-level identity |
| Downgrade to 4G/3G/2G | Not protected. Bidding-down attacks demonstrated by researchers in 2023 and again with Sni5Gect in 2025 push phones onto legacy networks where IMSI catching and weak or null ciphers return | A fake base station gets the IMSI after a downgrade | The genuine gap a VPN covers: tunnel content stays encrypted even on a hostile legacy network |
| DNS queries | Not covered by the 5G specs at all | Every domain you look up, at the carrier's resolver | DNS moves inside the tunnel to the VPN provider's resolvers; the carrier sees none of it |
| Destination IPs and hostnames (SNI) | Not protected; 5G encrypts the radio hop, then hands plain IP packets to the core network | Every server you connect to, with hostnames via SNI | The carrier sees one endpoint: the VPN server |
| App content (HTTPS) | Wrong layer; TLS protects content end to end on any network | Metadata only: who, when, how much | No added content secrecy on top of TLS; what it hides is the metadata |
| Traffic classification and throttling | Nothing; carriers classify flows and shape them. The Wehe project, in 2018 tests, measured Netflix at 1.77 Mbps on a US carrier while other traffic ran almost four times faster | Flow type, via SNI, IPs and DPI | Class-based rules cannot match tunneled traffic, though a carrier can still slow all VPN traffic or deprioritize by volume |
| Roaming interconnects and lawful intercept | Weak on the first (ENISA warned SS7 and Diameter era flaws persist on interconnects); the second is mandated in the core by design | Location queries and SMS interception risk at interconnects; full metadata domestically | Data content crossing interconnects stays encrypted; signalling-level location tracking and SIM identity are untouched |
Read the table's middle column top to bottom and one sentence summarizes it: 5G solved radio interception and left everything past the base station exactly as visible as it was on 4G. That yields the clean definition this topic needs: on 5G, a VPN is not protection against radio sniffing, which the standard already provides; it is a choice about who sees your traffic metadata, moving that visibility from the mobile carrier to the VPN provider.
Does a VPN slow down 5G?
Here the honest answer needs two numbers that almost never appear on the same page: what 5G actually delivers, and what VPN protocols can carry. No field benchmark of "VPN over 5G" exists in the public literature, so the correct method is to compare measured carrier medians with measured protocol ceilings.
| Evidence | Figure | Source |
|---|---|---|
| US median 5G download, fastest carrier | 299.36 Mbps (H1 2025), 309.41 Mbps (H2 2025), T-Mobile | Ookla Speedtest Intelligence |
| US median 5G download, other carriers | Verizon about 215 Mbps, AT&T 158.56 Mbps (H1 2025) | Same Ookla reporting |
| World's fastest mobile medians | UAE 546.14 Mbps, Qatar 517.44 Mbps; US 14th at 165.57 Mbps (all-technology mobile) | Ookla Global Index, June 2025 |
| Fastest 5G operators globally | KT and SK Telecom above 460 Mbps 5G download, per GSA's summary of Opensignal data | GSA, Nov 2025 |
| WireGuard vs OpenVPN, same gigabit testbed | WireGuard saturated the 1 Gbps link; OpenVPN reached roughly a quarter of it | WireGuard project benchmark |
| Academic confirmation | WireGuard led throughput tests on high-speed hardware; OpenVPN was CPU-bound on a single core | IFIP Networking 2020 |
Put the two halves of the table together and the conclusion writes itself: the fastest operators' median 5G sits above 460 Mbps, the fastest country's all-technology mobile median is about 546 Mbps, US medians run 160 to 310 Mbps, and WireGuard's ceiling on ordinary hardware sits near a full gigabit, three times the best US median. With a modern protocol, the tunnel is simply not the bottleneck; expect single-digit percentage overhead. The one protocol that can visibly cap a fast 5G connection is OpenVPN, whose single-core design tops out at a few hundred Mbps on typical hardware, below what a good 5G cell now delivers. Two honest caveats: a distant or overloaded VPN server adds latency no protocol fixes, and these are lab ceilings against field medians, not a combined field test, because none has been published.
What 5G-era problems does a VPN genuinely fix?
Three, and they are more specific than the marketing version. Downgrade exposure: your phone says 5G, but researchers keep demonstrating silent pushes to 4G and even 2G, where IMSI catchers and null ciphers still work; a tunnel's encryption does not care which generation of network is underneath it. Traffic-class throttling: the Wehe measurements from 2018 documented carriers slowing video streams by traffic class, and a classifier cannot sort what it cannot read, though nothing stops a carrier deprioritizing all tunneled traffic. And CGNAT: most mobile carriers put 5G users behind carrier-grade NAT by default, sharing public IPv4 addresses and breaking inbound connections, port forwarding and some peer-to-peer uses; a VPN connection with a dedicated or port-forwarded exit restores inbound reachability and a stable address. For the protocols themselves, Le VPN runs WireGuard alongside OpenVPN and IKEv2, and on 5G the first is the one to pick for the speed reasons above.
What does a VPN not fix on 5G?
Four things, stated without hedging. Your SIM identity: the carrier issued it and always knows the subscriber, tunnel or no tunnel. Cell-tower location: your phone's radio presence locates you to the network independently of any traffic. Signalling-level tracking across roaming interconnects, which operates below the IP layer a VPN occupies. And the metadata of the tunnel itself: the carrier sees that you connect to a VPN endpoint, when and how much, even while seeing nothing inside it; what happens to that observation then depends on the laws where you are, a legal patchwork that varies as sharply as the UK's age-check era and South Korea's blocking regime show.
What changes next
Three files worth a date in the calendar. Standalone 5G cores keep spreading, which moves roaming off the legacy Diameter stack and gradually closes the interconnect weaknesses ENISA flagged. User-plane integrity at full rate, the Release 16 fix for the 64 kbps embarrassment, still depends on operators switching it on, and public documentation of who has remains thin. And the downgrade-attack literature is compounding yearly, with the 2025 Sni5Gect work showing injection without a rogue base station, so the one 5G gap a VPN squarely covers is not closing soon. We will refresh the speed medians when Ookla's next cycle lands.
About the author
Le VPN Blog Editor
Alan Summers has been writing and editing for the Le VPN blog for years, covering online privacy, cyber security, and the best ways to get the most out of a VPN. He keeps a close eye on the news that affects internet freedom around the world and turns it into practical advice for Le VPN readers.
Articles by Alan Summers →
