WireGuard Config Generator

WireGuard is a small, fast VPN built into current Linux kernels and available for Windows, macOS, iOS and Android. Setting it up means generating key pairs and writing two configuration files whose keys refer to each other. The page does the arithmetic in your browser and fills in the files, so you only copy them to the right machines.

Keys without a command line

A WireGuard key pair uses Curve25519. The private key is 32 random bytes in which a few bits are fixed (clamped) as RFC 7748 requires; the public key is the private key multiplied by the curve’s base point. Both are written in Base64, 44 characters long. The usual command line tool does exactly this with wg genkey and wg pubkey. The page uses the browser’s secure random generator for the private key and its own implementation of the curve arithmetic, checked against the test vectors in RFC 7748.

Filling in the form

Enter the server’s endpoint (host and port), the listen port (51820 by default), the tunnel addresses of server and client, the DNS server to give the client, the allowed IPs for the client and an optional persistent keepalive. Tick the preshared key option for the extra symmetric secret. Generate new keys and files creates both files and shows the two public keys, which are safe to share, for checking.

What the files contain

The server file has an [Interface] section with the tunnel address, listen port and the server’s private key, and a [Peer] section with the client’s public key and the single address it may use (AllowedIPs = 10.8.0.2/32). The client file has an [Interface] with its own address, private key and DNS, and a [Peer] section naming the server’s public key, the endpoint, the routed networks and the keepalive. A keepalive of 25 seconds keeps a client behind NAT reachable. If you enabled the preshared key, both peers get the same PresharedKey line.

Keeping the keys safe

Anyone who holds a private key can act as that peer. The page generates keys locally and does not store them, so copy each file straight to the device that needs it, for example by a secure transfer, and do not paste them into chat tools or tickets. For a high-value server, generate the key pair on the server itself instead of in any web page. The second panel, which shows the public key for a private key, is meant for a throwaway key to see how derivation works.

A worked example

With the defaults, the server gets the tunnel address 10.8.0.1/24 and listens on 51820. The client gets 10.8.0.2/32 and DNS 1.1.1.1, with the endpoint vpn.example.com:51820, AllowedIPs 0.0.0.0/0, ::/0 and a PersistentKeepalive of 25. The two public keys, 44 characters each, appear in both files. Because the keys are random, they differ on every run.

Limits

The page writes the WireGuard files only. The server still needs IP forwarding, firewall rules and NAT for clients to reach the Internet through it, and the UDP port must be open. It generates one server and one client; for more peers repeat the process and add further [Peer] sections by hand. Choose a safe MTU for the tunnel with the MTU and MSS Calculator.

Related tools

• MTU and MSS Calculator shows the 1420 or 1440 byte tunnel MTU to configure.
• Subnet Calculator helps pick the tunnel network.
• WebRTC Leak Test checks whether a VPN hides your address from web pages.
• Port Number Lookup shows what is commonly assigned to the port you choose.