What Is ChaCha20 Encryption? How It Works, Where It's Used, and Why It Matters

Key Takeaways

• ChaCha20 is a 256-bit stream cipher designed by Daniel J. Bernstein, used in WireGuard, TLS 1.3, and SSH.
• It generates a pseudorandom keystream using addition, bit rotation, and XOR – no hardware acceleration required.
• ChaCha20-Poly1305 pairs the cipher with Poly1305 for authenticated encryption, protecting both privacy and integrity.
• ChaCha20 is faster than AES on devices without dedicated AES hardware, such as most mobile devices.
• WireGuard uses ChaCha20-Poly1305 as its encryption standard.

Most encryption explainers stop at "your data is scrambled," which is accurate and useless. ChaCha20 is worth understanding in a bit more detail, partly because it is the cipher protecting a growing share of internet traffic, and partly because the reasons it was chosen over the older standard say something about how modern cryptography is designed. 

This is the cipher behind every WireGuard connection, and it works differently from what most people picture when they hear the word encryption. A broader look at how VPN encryption works covers the surrounding process.

What Is ChaCha20?

ChaCha20 is a symmetric stream cipher designed by Daniel J. Bernstein in 2008. It encrypts data by generating a pseudorandom keystream and combining that keystream with the plaintext using XOR operations, and because XOR is its own inverse, the identical process also decrypts. 

It takes a 256-bit key, a 96-bit nonce, and a block counter, which together ensure every session produces a completely different keystream. Unlike block ciphers, it handles data of any length directly, with no padding.

How ChaCha20 Works

ChaCha20 arranges its inputs – the 256-bit key, the 96-bit nonce, and a 32-bit block counter – into a 4x4 matrix of 32-bit words, then runs 20 rounds of three operations over it: addition, bit rotation, and XOR. This is known as an ARX design, and it’s why the cipher runs quickly in plain software: every operation is one a general-purpose CPU already does well, with no lookup tables involved.

Each pass produces a 512-bit keystream block, XORed with 64 bytes of plaintext. The counter increments and the process repeats for as long as there is data. 

Because the operations run in constant time regardless of input values, ChaCha20 resists the timing and side-channel attacks that table-based ciphers have been vulnerable to.

ChaCha20 Key Technical Characteristics

• 256-bit key. A fixed 32-byte secret key, giving a keyspace of 2^256.
• 96-bit nonce. Unique per session under the IETF standard, which is what guarantees distinct keystreams from the same key.
• No padding. As a stream cipher, it works on data of any length without block boundaries, so ciphertext is exactly as long as plaintext.
• Software-fast. Exceptionally quick on mobile devices, routers, and any CPU without AES hardware instructions.

ChaCha20-Poly1305 – Authenticated Encryption

ChaCha20 on its own provides confidentiality: it makes data unreadable. It doesn’t tell the recipient whether the data arrived unaltered, which is a real weakness, since an attacker who cannot read a message can still tamper with it. 

Pairing the cipher with the Poly1305 message authentication code produces ChaCha20-Poly1305, an AEAD scheme – Authenticated Encryption with Associated Data. It encrypts the payload and verifies integrity in one pass, and it is the construction deployed in TLS 1.3, SSH, and WireGuard.

Where ChaCha20 Can Go Wrong: Nonce Reuse

Stream ciphers have one catastrophic failure mode, and ChaCha20 isn’t exempt from it. If the same key and nonce (the number or bit string used only once, not the British slang name for sex offenders) pair is ever used to encrypt two different messages, both messages are compromised. 

XOR the two ciphertexts together, and the keystream cancels out, leaving the two plaintexts XORed with each other – recoverable with basic analysis and no need to attack the cipher at all.

This isn’t a flaw in ChaCha20's mathematics. It is a property of how stream ciphers work, and it’s why the 96-bit nonce and the block counter exist. Well-designed protocols handle nonce management automatically: WireGuard derives fresh keys for each session and increments counters strictly, so the same nonce is never reissued under the same key. 

The risk lives in hand-rolled implementations, which is a good argument for using an established protocol rather than assembling one.

ChaCha20 vs AES: Which Is Better?

Neither is strictly better, and the honest answer depends on what the code is running on. AES-256 with hardware acceleration – Intel AES-NI, or the ARM Cryptography Extension – is extremely fast and is the most widely deployed cipher in the world, with a longer track record and NIST standardization behind it. 

ChaCha20 is faster on hardware that lacks those instructions, which covers a large share of mobile phones, IoT devices, and consumer routers.

The design difference matters too. ChaCha20 is simpler, with fewer moving parts, which makes independent review more tractable, and its constant-time operation removes a class of side-channel risk by construction rather than by careful implementation. 

AES has two decades of sustained cryptanalysis behind it and no practical break. WireGuard chose ChaCha20-Poly1305 for mobile performance and simplicity; TLS 1.3 supports both. A closer look at AES-256 vs ChaCha20 covers the older standard in depth.

Where ChaCha20 Is Used

ChaCha20-Poly1305 is deployed across a large share of the modern internet: TLS 1.3 secures HTTPS connections with it, SSH offers it for remote sessions, and WireGuard uses it as its only encryption method. 

Google adopted it for HTTPS traffic on Android, where the performance gap on phones without AES instructions was substantial enough to justify the switch. That mobile advantage is the recurring reason it gets picked.

See our WireGuard vs OpenVPN comparison for more on protocol differences.

ChaCha20 and Mysterium VPN

Mysterium VPN uses WireGuard as its default protocol, and WireGuard uses ChaCha20-Poly1305 with no cipher negotiation at all – so every WireGuard connection on Mysterium VPN is encrypted with ChaCha20 and authenticated with Poly1305, without a setting to configure or get wrong. 

That fixed-suite approach is deliberate: no negotiation means no downgrade attack and no misconfigured cipher. The WireGuard uses ChaCha20 encryption page covers the protocol implementation, and the trade-offs against the older alternative are laid out in this WireGuard vs OpenVPN comparison. 

Readers who want it running across 15 devices can get Mysterium VPN from $2.99/mo.