Why PPTP Is an Outdated VPN Protocol

Few technologies in networking have aged as badly as PPTP. In the late 1990s, setting up a VPN was a hard job, and PPTP made it easy: Windows could connect to a PPTP server without extra software, and plenty of routers and servers could host one. That convenience made it the first VPN protocol that millions of people ever used. Today, the same menu entry that once felt like a shortcut is something security guidance tells you to avoid.

This article explains in plain language why a PPTP VPN is considered unsafe, what exactly is weak about it, where you might still run into it, and what to switch to. It focuses on PPTP alone. For the general idea of what a protocol is, see our introduction to VPN protocols.

What PPTP is and why it spread so quickly

PPTP stands for Point-to-Point Tunneling Protocol. It was developed in the mid-1990s by a group of vendors led by Microsoft, at a time when companies wanted staff to dial in to office networks over the ordinary internet instead of paying for private leased lines or modem pools.

Several things made it popular:

• It was built in. Client support arrived with major desktop operating systems, so no extra installation was needed.
• It was cheap to run. The processing load was small, which mattered on early servers and consumer routers.
• It was simple to configure. A server address, a username and a password were enough.
• It was widely documented. Guides for home-office users filled the internet.

The design reflected the era. Cryptography was treated as an add-on to a tunnel that was mainly meant to carry traffic, and the standards of the day assumed attackers had far less computing power than they do now. That assumption did not hold up.

How PPTP works in simple terms

A PPTP connection uses two separate pieces.

1. A control connection on TCP port 1723. This is where the client and server negotiate and keep the session alive.
2. A data tunnel that uses a different protocol called GRE (Generic Routing Encapsulation, IP protocol 47). Your traffic is wrapped in PPP frames, then inside GRE packets.

The login step is handled by PPP authentication, most commonly a Microsoft method named MS-CHAPv2. Optional encryption is provided by MPPE (Microsoft Point-to-Point Encryption), which uses the RC4 stream cipher with keys derived from your password.

Notice what is different from modern designs. The encryption keys are not made from a fresh, independent key exchange. They come from the same password that logs you in. So the strength of the whole tunnel rests on the strength of one login exchange.

The weaknesses, one by one

1. MS-CHAPv2 can be reduced to a single hard problem

In 2012, researchers showed that the MS-CHAPv2 handshake used by PPTP can be collapsed into a problem of finding one 56-bit DES key. A 56-bit key is small by modern standards, and specialised hardware and online services were able to recover it in a day or less. Once that key is known, the password hash behind it is exposed, and with it the MPPE session keys. In practice this means someone who records a PPTP login exchange can later recover what is needed to decrypt the session.

2. RC4 in MPPE has known problems

The RC4 cipher has a history of statistical biases and has been withdrawn from modern web security. In MPPE there is a further issue: the scheme does not provide strong integrity protection. Researchers have demonstrated that an active attacker could flip bits in encrypted data without the receiver noticing, which opens the door to tampering attacks even where the content is encrypted.

3. No strong, separate key exchange

Because session keys derive from the password, there is no equivalent of the forward secrecy found in current protocols. If a password or its hash is later recovered, previously recorded sessions can be decrypted. Modern designs avoid this by creating temporary keys that are thrown away after each session.

4. Optional encryption and weak defaults

PPTP can be configured without MPPE at all, or with its weaker 40-bit mode. Older guidance sometimes recommended the 128-bit option as "strong", but that does not repair the authentication flaw underneath.

5. Identity of the server is weakly protected

PPTP has no robust certificate-based way for your device to verify the server. That leaves room for impostor gateways, a problem that proper server verification is meant to prevent.

The summary of those five points is simple: even with the strongest PPTP settings available, the protocol does not deliver the confidentiality and integrity that people expect from a VPN.

What an attacker could realistically do

It helps to translate the technical points into everyday scenarios.

The cafe observer. Someone on the same public network records the traffic of a PPTP user. They do not need to break anything in real time. They store the handshake and the encrypted stream, and process them later at their leisure.

The cracked password. If the user's password is short or reused, the effort needed falls even more. Long random passwords make the offline guessing harder, but the reduction to a single DES key means they do not remove the design weakness.

The old network gear. A small business runs a PPTP server on a ten-year-old router so staff can reach a shared drive from home. Everything works, nobody has touched the settings in years, and the router firmware has had no security updates. The VPN gives a feeling of safety while offering little actual protection, and the exposed router becomes a target in its own right.

The silent tamperer. An active attacker with access to the path can alter encrypted traffic in ways the PPTP layer does not detect. Even if they cannot read the contents, they may be able to interfere with them.

None of this requires a movie-style genius. The attacks are documented, tooling exists, and security teams and auditors flag PPTP as a finding in almost every review.

How PPTP compares with other protocols

The table gives a general comparison. It describes protocols in general and does not say what any particular service offers.

Protocol	Age	Typical state today	Main concern
PPTP	1990s	Obsolete, avoid	Broken authentication and weak encryption
L2TP/IPsec	Early 2000s	Legacy but usable with good settings	Double encapsulation, older cipher choices, fixed ports
SSTP	2000s	Niche, Windows-centred	Single vendor ecosystem; TCP-over-TCP slowdowns
IKEv2/IPsec	2000s	Current and well regarded	Configuration complexity on custom setups
OpenVPN	2001	Current and widely audited	Heavier than newer designs
WireGuard	Late 2010s	Current, compact	Simple key model needs careful management

If you want to see how the two most common modern options differ, read WireGuard vs OpenVPN. For the standards side, NIST's guide to IPsec VPNs and the IKEv2 specification show how a modern protocol negotiates and renews keys; they are good references if you ever need to justify a decision to a manager or auditor.

Where you may still meet PPTP

You are unlikely to choose PPTP deliberately today, but you can run into it by accident.

• Router menus. Some home and small-office routers still list a PPTP server or client option next to newer ones.
• Old NAS and server appliances. A network storage box from a decade ago may have a PPTP service switched on.
• Corporate legacy. An old remote-access system that nobody wants to touch because "it still works".
• Tutorials and forum posts. Search results from years ago still recommend PPTP because it is quick to set up.
• Operating-system lists. Some systems keep PPTP in a drop-down list of VPN types for compatibility, even if their vendors have removed it from newer versions or disabled it by default.

Seeing PPTP in a list is not a recommendation. Pick from the options your device offers that match current practice, or use an app from a service you have decided to trust.

A practical plan for replacing PPTP

Here is a step-by-step checklist for anyone who finds PPTP in their setup.

1. Inventory. Write down every place PPTP is enabled: routers, servers, NAS devices, laptops, phones.
2. Find the owner. For each item, identify who depends on it. A shared drive used by two people is simpler than a payroll system.
3. Check what replaces it. Look at your router or server firmware for WireGuard, OpenVPN or IKEv2/IPsec support. If a firmware update adds it, install the update first after a backup.
4. Plan the cutover. Set up the new VPN in parallel, test with one user, then move the rest.
5. Change credentials. Assume any password used over PPTP could have been recorded. Set new, unique passwords, and enable two-factor authentication where the system allows.
6. Turn PPTP off. Disable the server, close TCP 1723, and remove any rule that forwards GRE traffic.
7. Retest. Confirm that nothing relied on the old tunnel, such as scheduled backups or printers.
8. Replace hardware that cannot be updated. If a device cannot run a supported protocol and no longer gets security updates, the right answer is a replacement, not another workaround.

If your VPN runs on a router, the article on VPN router vs VPN app explains the trade-offs of each approach, and the help guide on setting up a VPN on a router covers the practical side.

Common mistakes and myths

"It is fast, so it is fine." Speed was once a selling point because the encryption was light. Newer protocols are fast without the weaknesses, so speed is no longer a defence.

"My password is very long." A long password helps against guessing, but the known attack reduces the handshake to a fixed-size problem, so length does not repair the design.

"I only use it at home." Home use still carries your traffic across a network you may not fully control, and a poorly maintained router is also exposed to the internet.

"HTTPS covers me anyway." HTTPS protects page contents, as explained in HTTPS vs VPN. It does not turn a weak VPN into a strong one, and it leaves the metadata that PPTP was supposed to hide.

"It is blocked sometimes, so it must be hardened." Some networks block GRE packets or port 1723, which is why PPTP often fails to connect. That is a compatibility problem, not a security feature.

"Nobody would bother attacking me." Many attacks are automated and opportunistic. Collecting and cracking handshakes does not need a human to care about the victim.

If you cannot replace it immediately

Sometimes a change takes weeks. Until then, reduce the damage.

• Treat the PPTP link as if it were an ordinary, unencrypted connection when deciding what to send through it.
• Do not use the same password for the PPTP account anywhere else.
• Limit the account to the single resource it needs.
• Avoid using it on public Wi-Fi, where recording traffic is easiest.
• Set a firm date to remove it, and write it down.

These steps are damage control, not a fix. They buy time until you can move to a current protocol.

Summary

PPTP was built for a different era and is now considered obsolete. Its authentication method can be collapsed into a small cracking problem, its encryption relies on an aging cipher with integrity weaknesses, and its keys derive from the login password rather than from a fresh exchange. You may still find it in old routers, storage boxes and tutorials, but its presence in a menu is not an endorsement. If you rely on it, inventory where it is used, move to WireGuard, OpenVPN or IKEv2/IPsec, change the passwords, and switch PPTP off.

If you would rather skip protocol decisions and use a ready-made app, you can look at the options on the pricing page.