What is WireGuard?

WireGuard is a modern, high-performance VPN protocol designed for simplicity and speed. Unlike older protocols such as OpenVPN or IPsec, WireGuard uses state-of-the-art cryptography (Curve25519 for key exchange, ChaCha20 for encryption, and Poly1305 for authentication) and runs with minimal code — roughly 4,000 lines compared to hundreds of thousands in legacy solutions. This lean design makes it easier to audit, faster to establish connections, and more reliable across network changes like switching between Wi-Fi and mobile data.

WireGuard works by creating encrypted point-to-point tunnels between a server and one or more clients. Each side holds a private key and knows the public key of its peers. Once configured, traffic flows through the tunnel seamlessly, with the protocol handling handshakes, key rotation, and keepalive packets automatically.

Tool description

This tool generates ready-to-use WireGuard configuration files for both server and client sides. It automatically creates cryptographically valid X25519 key pairs, builds properly formatted .conf files, and lets you manage multiple clients from a single interface. You can download each configuration file directly or scan a QR code for quick mobile setup.

Examples

Server configuration output:

[Interface]
PrivateKey = aGVsbG93b3JsZC4uLi4uLi4uLi4uLi4uLi4uLi4=
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
SaveConfig = true

[Peer]
PublicKey = Y2xpZW50cHVibGlja2V5Li4uLi4uLi4uLi4uLi4=
AllowedIPs = 10.0.0.2/32

Client configuration output:

[Interface]
PrivateKey = Y2xpZW50cHJpdmF0ZWtleS4uLi4uLi4uLi4uLi4=
Address = 10.0.0.2/32
DNS = 1.1.1.1, 1.0.0.1

[Peer]
PublicKey = c2VydmVycHVibGlja2V5Li4uLi4uLi4uLi4uLi4=
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

Features

  • Generates cryptographically valid X25519 key pairs directly in the browser using Curve25519
  • Produces downloadable .conf files for both server and all clients
  • Displays QR codes for client configs, enabling instant mobile device setup
  • Supports multiple clients with automatic IP address assignment
  • Configurable MTU, PostUp/PostDown hooks, DNS, and PersistentKeepalive per client

Options explained

  • Server name — a label used in the config file comment and download filename
  • Server port — the UDP port WireGuard listens on (default: 51820)
  • Server IP address — the VPN subnet address for the server interface (e.g., 10.0.0.1/24)
  • Server endpoint — the public hostname or IP and port that clients connect to
  • MTU — maximum transmission unit size; leave empty to use the system default (typically 1420)
  • PostUp / PostDown — shell commands executed when the interface is brought up or down (commonly used for iptables NAT rules)
  • Allowed IPs — IP ranges the client routes through the tunnel; 0.0.0.0/0, ::/0 routes all traffic
  • DNS — DNS servers the client uses while connected
  • PersistentKeepalive — interval in seconds for keepalive packets, useful for clients behind NAT (default: 25)

Use cases

  • Setting up a self-hosted VPN server on a cloud instance to encrypt all traffic from laptops and phones
  • Connecting remote office networks through a secure site-to-site WireGuard tunnel
  • Generating client configs with QR codes for quickly onboarding team members or mobile devices