The Point-to-Point Tunneling Protocol (PPTP) is a VPN protocol used to secure the connection between your device and a VPN server. One of the oldest VPN protocols, PPTP is plagued by multiple security issues and is now considered obsolete.

Despite this, its broad compatibility with a huge range of legacy software and hardware, its ease of setup, its lightweight nature, plus the high cost for businesses to upgrade their old PPTP corporate intranet VPN systems, means that in 2021 the protocol remains in widespread use.

What is a VPN protocol?

The VPN protocol is a mix of transmission protocols and encryption standards that establish a secure connection between your device and a VPN server, and encrypts data as it travels between them. 

A VPN protocol should provide three things:

  • Authentication – prevents unauthorized users from connecting to the VPN server
  • Confidentially – using encryption to ensure that no one can access (“sniff”) the contents of data packets sent over the VPN network
  • Integrity – detects if transmitted data has been tampered with in any way

VPN protocols used today include:

  • PPTP
  • L2TP/IPsec
  • IKEv2 (/IPsec)
  • OpenVPN
  • WireGuard®
  • SSTP
  • SoftEther
  • Cisco AnyConnect (and its open-source variant OpenConnect) – these protocols are used almost exclusively by corporate VPN intranets, not by commercial VPN services, such as Proton VPN.

Learn more about VPN protocols(new window)

Learn more about WireGuard(new window)

What is PPTP VPN?


Developed by a consortium founded by Microsoft, the specification for PPTP was designed for creating VPN connections over dial-up networks and was published in 1999. Microsoft quickly added PPTP support to Windows 95, with the result that it quickly became the default VPN protocol for corporate intranets everywhere.  


Over the last 20+ years, support for PPTP has been built-in to almost every VPN-capable platform, and it continues to be natively supported by Windows 11, Android 12, most Linux distros, and the vast majority of VPN-capable routers.

Apple, however, removed(new window) support for PPTP from iOS 10+ and macOS 10.12 Sierra in 2018, and recommended against its use on older versions of its operating systems.

Recent versions of Chrome OS do not support PPTP directly, but it is possible to configure PPTP connections using the Android subsystem on Chromebooks that support the Google Play Store. 

How it works

PPTP is a tunneling protocol(new window), not, in itself, a complete VPN protocol. Encryption and authentication are handled by the Point-to-Point Protocol(new window) (PPP), but PPP includes no routing mechanism to direct packets to their destination.

PPTP establishes a TCP connection to the VPN server over port 1723, repackaging the PPP IP packets using Generic Routing Encapsulation(new window) (GRE). These packets are encrypted with Microsoft Point-to-Point Encryption(new window) (MPPE), which uses an RSA RC4 stream cipher(new window) with a maximum key size of 128-bits. 

Authentication is usually achieved using the MS-CHAP (now v2) protocol. (It is possible(new window) to use the more secure AEP-TLS, but this involves implementing a server certificate system, which largely negates the advantages of using PPTP in the first place.)


PPTP is a very simple and lightweight VPN protocol. This makes for good speed performance (especially on devices with low processing power), and good battery life on mobile devices. This is especially true when compared to the much more secure (but also more cumbersome) OpenVPN protocol. 


PPTP is known to have numerous critical security issues. One the most serious of these is the possibility of un-encapsulated MS-CHAP v2 authentication, which can allow an attacker to exploit cryptographic weaknesses to obtain user credentials.

Using this exploit, tools first released by crypto-legend Moxie Marlinspike in 2012 allow PPTP to be cracked in under a day(new window). This flaw led Microsoft itself to recommend(new window) using L2TP/IP, IKEv2, IPsec, or SSTP instead. 

In 2019, Microsoft also issued an “Applicability Statement(new window)”, noting that the authentication method used by MS-CHAP v2 is susceptible to dictionary attacks(new window). To make matters worse, the RC4 cipher used by PPTP to encrypt data is vulnerable to bit-flipping attacks(new window).

It therefore came as very little surprise when, in 2014, Der Spiegel (new window)released documents obtained from whistleblower Edward Snowden that confirmed the United States’ NSA has little problem accessing data secured using PPTP. 

Top secret slide obtained from Edward Snowden detailing how the NSA easily breaks PPTP encryption

Resistance to censorship

PPTP uses TCP port 1723, and packets encapsulated by GRE use IP protocol number(new window) 47, both of which are trivial to block using a firewall. 


PPTP is not a secure VPN protocol, and should never be used in any situation where security is a factor.

Its ease of use, lightweight nature, and almost ubiquitous support mean that it can still be useful in situations where security is not an issue. For example, use cases include when you need to overcome IPS throttling, unblock geo-restricted websites, and stream Netflix content that you’ve subscribed to while traveling abroad.

However, at Proton VPN we believe this obsolete protocol’s security weaknesses make it unfit for purpose, and that it is irresponsible for modern commercial VPN services to provide PPTP as an option to their users.

At Proton VPN we only offer cryptographically secure VPN protocols implemented at their highest security settings. These protocols are:

  • OpenVPN 
  • IKEv2
  • WireGuard

Frequently asked questions

What port does PPTP use?

PPT uses TCP port 1723.

What is PPTP passthrough?

All routers use Network Address Translation (NAT) to map incoming and outgoing connections to local devices that are connected to them. However, not all routers understand what to do with packets that have been encrypted using older VPN protocols, such as PPTP, IPSec, and L2TP. 

To handle traffic that uses these VPN protocols, a router must support VPN passthrough. If it doesn’t, the VPN traffic will be blocked by the router. A PPTP passthrough replaces the basic GRE protocol used by PPTP with an enhanced version that includes a call ID it can use to identify PPTP clients and correctly route their packets. 

Most modern routers include a VPN passthrough that can handle all the common VPN protocols that are affected by this issue (including PPTP). In addition to this, modern VPN protocols, such as OpenVPN, IKEv2, and Wireguard are not affected by this issue as they have been designed to address it. 

Do I need a PPTP client?

Most VPN-capable devices and operating systems include a native PPTP VPN client. A major exception is Apple devices, which no longer support PPTP. This is a good move on Apple’s part because more modern VPN protocols can do everything PPTP does while also being much more secure. 

Protect your privacy and security online
Get Proton VPN free

Related articles

What is AirTag stalking?
In an era of “smart devices” that often double as spy devices, AirTags are tracking tools that are open about their function and can be vital in helping locate lost items (as anyone who has lost their car keys can attest to). However, as a recent cla
How to fix a "Your connection is not safe" error
As you surf the web using your browser, you’ll no doubt encounter websites that your browser will refuse to load, instead showing some variation of an error message, such as Your connection is not private or Warning: Potential Security Risk Ahead. 
Your search history is a window into your inner life. Anyone with access to it knows what your hobbies and interests are, your sexual orientation and preferences, the things that worry you (for example your medical concerns), your political affiliati
how to flush dns blog
  • Privacy deep dives
A DNS cache is a record of all the websites you’ve visited over a set amount of time. Simply put, your DNS cache is a list of websites you visited in the past that’s stored on your device. Your computer uses it to speed up visits to those same websit
Is Temu legit?
  • Privacy basics
Temu has become an unavoidable brand. Unknown to most up to a year ago, the online retailer exploded onto the digital scene in the United States with lavish ads and a riveting social media campaign, and has started its takeover in Europe now, too. As
We examIne whether the controversial Chinese video platform is safe to use
  • Privacy basics
In this article, we take an in-depth look at whether the wildly popular social media platform TikTok is safe to use. Several countries recently banned government officials from using TikTok, and now the US House of Representatives has passed the Pro