WireGuard Config Generator
Generate a production-ready WireGuard server + client config in seconds. Real cryptographic keys generated locally in your browser. Nothing ever leaves your device.
All keys are generated in your browser (Curve25519 / X25519). Nothing is sent to our servers - your config stays 100% private.
Optional. Enter the LAN subnet behind the server and/or behind a client that acts as a site gateway (a router, a Raspberry Pi, a NAS). The generator adds each LAN to the server's AllowedIPs, gives every peer the routes to the other LANs, and writes the forwarding rules on the gateways. Leave a field empty for a normal client.
Tunnel will not come up after you import these files?
The kit's 12-cause checklist goes in diagnostic order (cloud firewall, OS firewall, Endpoint, NAT, keys, clock, AllowedIPs, MTU, DNS), each with the command that confirms it and the fix.
WireGuard key generator: public key from a private key
Already have a PrivateKey line and need the matching public key for the other side's [Peer] block? Paste it here. This is the same computation as `wg pubkey`.
Command line equivalent: echo "PRIVATE_KEY" | wg pubkey
Looking for the opposite (public key to private key)? It cannot be done, by anyone: that is what keeps the tunnel secure. If the private key is lost, generate a new pair and replace the PublicKey on the other side.
Computed in your browser. Nothing is sent or stored.
WireGuard config checker: test a .conf before wg-quick up
Paste a WireGuard config you already have (client or server). The checker reads it like wg-quick does and lists what will stop the handshake. Replace the PrivateKey with any other valid key if you prefer: the checks still work.
Checked in your browser. Nothing is sent or stored.
More than one server, or more than three devices? Keep your configs in one place.
This generator makes one config and forgets it. WireGuard Manager, our hosted tool, keeps your servers and peers, allocates IP addresses, regenerates wg0.conf on every change, gives you QR codes and revokes a device in one click. Unlike this generator, it creates and stores your keys on its server (encrypted). Free for 1 server and 3 peers, 9 EUR per month beyond that. Already running WireGuard? Import your existing wg0.conf: keys and peers stay exactly as they are.
Open WireGuard Manager (free)Every line of a WireGuard config file, explained
The generator writes a standard wg-quick file: one [Interface] block for this device, one [Peer] block per device it talks to. Here is what each key does, and the mistake that most often breaks it.
| Section | Key | What it does | What breaks it |
|---|---|---|---|
| [Interface] | PrivateKey | This device's private key (base64). Never leaves the device, never shared. | Generated in your browser by the tool above. |
| [Interface] | Address | The tunnel IP of this device, with its mask, e.g. 10.8.0.2/32 on a client, 10.8.0.1/24 on the server. | A typo here gives a working handshake and no traffic. |
| [Interface] | ListenPort | UDP port the server listens on. 51820 by convention. Clients usually omit it and get a random port. | Must match the port forwarded on the router and opened in the firewall. |
| [Interface] | DNS | Resolver set by wg-quick when the tunnel comes up (client only). | Without it, DNS queries can leave outside the tunnel. |
| [Interface] | MTU | Optional. wg-quick picks one automatically; 1420 is the usual value, lower on PPPoE or mobile links. | Too high: the handshake works, large pages and downloads stall. |
| [Interface] | PostUp / PostDown | Shell commands run after the interface goes up or down, typically the NAT and forwarding rules on the server. | A wrong outbound interface name (eth0 vs ens3) cuts internet access for every client. |
| [Peer] | PublicKey | The public key of the other side. The server lists each client's key; each client lists the server's key. | Pasting a private key here is the most common copy-paste error. |
| [Peer] | PresharedKey | Optional extra symmetric key, same value on both sides of one peer pair. | If the two ends differ, the handshake fails without a clear error. |
| [Peer] | Endpoint | Public IP or hostname and port of the server (client side only). | Behind CGNAT the server is unreachable whatever this line says. |
| [Peer] | AllowedIPs | Destinations routed into the tunnel (client side) and source IPs accepted from that peer (server side). 0.0.0.0/0, ::/0 means full tunnel. | On the server, each client must get its own /32: two peers with the same range overwrite each other. |
| [Peer] | PersistentKeepalive | Seconds between keepalive packets, 25 is the usual value. Keeps the NAT mapping open for a client behind a router. | Only needed on the side behind NAT; pointless on a public server. |
Config generated but no handshake? Check the port and CGNAT with the WireGuard port checker. Pages stall once connected? Size the MTU with the MTU calculator. Need to exclude your LAN or route only some IPs? Build the list with the AllowedIPs calculator.
How to use this generator
- 01
Fill in the form
Enter your server's IP or domain, listening port (default 51820), VPN subnet, DNS resolver and the number of clients.
- 02
Click Generate
Real Curve25519 key pairs are generated in your browser using WebCrypto. Nothing is sent to our servers.
- 03
Deploy the server config
Copy or download wg0.conf. On your VPS: sudo cp wg0.conf /etc/wireguard/ && sudo wg-quick up wg0. Enable on boot: sudo systemctl enable wg-quick@wg0.
- 04
Deploy client configs
Copy each client.conf to the client device, or scan the QR code with the WireGuard mobile app.
Why self-host your own VPN?
Commercial VPN providers hold your traffic logs, share jurisdictions with surveillance alliances and can disappear overnight. With a self-hosted WireGuard VPN on a €5.50/mo Contabo VPS, you own the exit IP, the keys never leave your machine, and you operate under GDPR (Germany) rather than CLOUD Act jurisdiction.
Host your WireGuard VPN on Contabo
A Contabo Cloud VPS 4 (4 vCPU, 8 GB RAM, unlimited bandwidth) is plenty for 10+ WireGuard tunnels. from €5.50/mo (list price checked 17 October 2026) - German datacenter, GDPR jurisdiction, dedicated IPv4.
Get Contabo Cloud VPS 4 →Affiliate link - we earn a commission at no extra cost to you.
Need the troubleshooting and hardening checklists too?
The WireGuard Self-Hosting Kit packs a 12-cause troubleshooting checklist, a 21-item hardening checklist, a cheat sheet with MTU and keepalive tables, 11 config templates (site-to-site, CGNAT reverse tunnel, wg-easy, nftables) and two helper scripts into one ZIP (PDF, Markdown and plain .conf files).
Get the kit (9 USD)Our own digital product, sold on Gumroad. The generator above stays free.
Frequently asked questions
Can I get a free WireGuard config?
Are the generated keys secure?
What is the default port 51820?
Full tunnel vs split tunnel - which should I choose?
How many clients can I add?
What VPS do I need to run WireGuard?
Your tunnel hides your IP. It does not hide your browser.
A correct WireGuard config replaces the address a site sees. It changes nothing about what your browser announces on its own, fonts, screen, time zone, graphics stack. That combination is often unique enough to follow you across sessions, tunnel or no tunnel.
Measure your own browser fingerprint - passive, no questions, no account, no email.