WireGuard Config Generator
Generate WireGuard key pairs in your browser and the wg0.conf files for a server and any number of peers, as a full tunnel or a split tunnel.
Free · No sign-up · Your inputs stay in your browser
Input
Generate WireGuard keys and configs
Output
No keys yet
Press the button to generate a key pair for the server and each peer.
Keys are Curve25519 pairs computed in this browser, the same as wg genkey | wg pubkey would give. A full tunnel needs IP forwarding on the server (net.ipv4.ip_forward=1 in /etc/sysctl.d) and the UDP port open. Start with wg-quick up wg0, or systemctl enable --now wg-quick@wg0. A pre-shared key adds a symmetric layer as a hedge against future quantum attacks on Curve25519.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Keys never leave the page
WireGuard keys are Curve25519 private scalars and their public points, the same as wg genkey | wg pubkey produces. They are computed here in JavaScript, so a VPN's private keys are never sent to a service. The protocol is described on wireguard.com.
Full or split tunnel
AllowedIPs = 0.0.0.0/0, ::/0 on the client sends all traffic through the server, which needs IP forwarding and NAT there. AllowedIPs set to the tunnel subnet only routes traffic for other peers and the server, leaving normal browsing direct. PersistentKeepalive keeps NAT mappings open for clients behind routers.