VPNSmith

Free tool

WireGuard Config Generator

Get the server wg0.conf and one .conf per device with its QR code for phones, all in one ZIP (up to 250 clients, free).

Keys are generated in your browser (tweetnacl, Curve25519). Nothing is sent to our servers.

You need a server: HostPapa VPS Lite (2.95 $/mo) or Contabo

Set up your tunnel

Public IPv4 or domain of the machine that will run WireGuard. No server yet? Leave it empty and add it later.

Free, no account: up to 250 clients, each .conf with its QR code, and one ZIP with every file.

Everything the device sends to the internet goes through your server.

Advanced settingsTunnel subnet, DNS, site-to-site LANs. The defaults work for most setups.

Optional. Enter the LAN subnet behind the server and/or behind a client that acts as a site gateway (a router, a Raspberry Pi, a NAS). The generator adds each LAN to the server's AllowedIPs, gives every peer the routes to the other LANs, and writes the forwarding rules on the gateways. Leave a field empty for a normal client.

What you download

  • wg0.conf

    for the server

  • client1.conf

    one per device

  • QR (sample)

    for the phone app

Illustration only: the lines and the QR code are fictional, no real key. Your real files are generated in your browser when you click.

Other WireGuard tools

Key generator: public key from a private key

WireGuard key generator: public key from a private key

Already have a PrivateKey line and need the matching public key for the other side's [Peer] block? Paste it here. This is the same computation as `wg pubkey`.

Command line equivalent: echo "PRIVATE_KEY" | wg pubkey

Looking for the opposite (public key to private key)? It cannot be done, by anyone: that is what keeps the tunnel secure. If the private key is lost, generate a new pair and replace the PublicKey on the other side.

Computed in your browser. Nothing is sent or stored.

Config checker: paste a .conf, find the errors

WireGuard config checker: test a .conf before wg-quick up

Paste a WireGuard config you already have (client or server). The checker reads it like wg-quick does and lists what will stop the handshake. Replace the PrivateKey with any other valid key if you prefer: the checks still work.

Checked in your browser. Nothing is sent or stored.

Go further

Tunnel will not come up after you import these files?

The kit's 12-cause checklist goes in diagnostic order (cloud firewall, OS firewall, Endpoint, NAT, keys, clock, AllowedIPs, MTU, DNS), each with the command that confirms it and the fix.

Troubleshooting kit, 9 USDFree cheat sheet (PDF, no sign-up)

More than one server, or more than three devices? Keep your configs in one place.

Keeps servers, peers and keys (encrypted, on our server), QR codes, one-click revoke. Free up to 3 peers.

Open WireGuard Manager (free)

Every line of a WireGuard config file, explained

The generator writes a standard wg-quick file: one [Interface] block for this device, one [Peer] block per device it talks to. Here is what each key does, and the mistake that most often breaks it.

SectionKeyWhat it doesWhat breaks it
[Interface]PrivateKeyThis device's private key (base64). Never leaves the device, never shared.Generated in your browser by the tool above.
[Interface]AddressThe tunnel IP of this device, with its mask, e.g. 10.8.0.2/32 on a client, 10.8.0.1/24 on the server.A typo here gives a working handshake and no traffic.
[Interface]ListenPortUDP port the server listens on. 51820 by convention. Clients usually omit it and get a random port.Must match the port forwarded on the router and opened in the firewall.
[Interface]DNSResolver set by wg-quick when the tunnel comes up (client only).Without it, DNS queries can leave outside the tunnel.
[Interface]MTUOptional. wg-quick picks one automatically; 1420 is the usual value, lower on PPPoE or mobile links.Too high: the handshake works, large pages and downloads stall.
[Interface]PostUp / PostDownShell commands run after the interface goes up or down, typically the NAT and forwarding rules on the server.A wrong outbound interface name (eth0 vs ens3) cuts internet access for every client.
[Peer]PublicKeyThe public key of the other side. The server lists each client's key; each client lists the server's key.Pasting a private key here is the most common copy-paste error.
[Peer]PresharedKeyOptional extra symmetric key, same value on both sides of one peer pair.If the two ends differ, the handshake fails without a clear error.
[Peer]EndpointPublic IP or hostname and port of the server (client side only).Behind CGNAT the server is unreachable whatever this line says.
[Peer]AllowedIPsDestinations routed into the tunnel (client side) and source IPs accepted from that peer (server side). 0.0.0.0/0, ::/0 means full tunnel.On the server, each client must get its own /32: two peers with the same range overwrite each other.
[Peer]PersistentKeepaliveSeconds between keepalive packets, 25 is the usual value. Keeps the NAT mapping open for a client behind a router.Only needed on the side behind NAT; pointless on a public server.

Config generated but no handshake? Check the port and CGNAT with the WireGuard port checker. Pages stall once connected? Size the MTU with the MTU calculator. Need to exclude your LAN or route only some IPs? Build the list with the AllowedIPs calculator.

How to use this generator

  1. 01

    Fill in the form

    Enter your server's IP or domain, listening port (default 51820), VPN subnet, DNS resolver and the number of clients.

  2. 02

    Click Generate

    Real Curve25519 key pairs are generated in your browser using WebCrypto. Nothing is sent to our servers.

  3. 03

    Deploy the server config

    Copy or download wg0.conf. On your VPS: sudo cp wg0.conf /etc/wireguard/ && sudo wg-quick up wg0. Enable on boot: sudo systemctl enable wg-quick@wg0.

  4. 04

    Deploy client configs

    Copy each client.conf to the client device, or scan the QR code with the WireGuard mobile app.

Why self-host your own VPN?

Commercial VPN providers hold your traffic logs, share jurisdictions with surveillance alliances and can disappear overnight. With a self-hosted WireGuard VPN on a €5.50/mo Contabo VPS, you own the exit IP, the keys never leave your machine, and you operate under GDPR (Germany) rather than CLOUD Act jurisdiction.

Self-hosted vs commercial VPN - full comparison →Self-hosting guide for beginners →

Host your WireGuard VPN on Contabo

A Contabo Cloud VPS 4 (4 vCPU, 8 GB RAM, unlimited bandwidth) is plenty for 10+ WireGuard tunnels. from €5.50/mo (list price checked 17 October 2026) - German datacenter, GDPR jurisdiction, dedicated IPv4.

Get Contabo Cloud VPS 4 →

Affiliate link - we earn a commission at no extra cost to you.

Need the troubleshooting and hardening checklists too?

The WireGuard Self-Hosting Kit packs a 12-cause troubleshooting checklist, a 21-item hardening checklist, a cheat sheet with MTU and keepalive tables, 11 config templates (site-to-site, CGNAT reverse tunnel, wg-easy, nftables) and two helper scripts into one ZIP (PDF, Markdown and plain .conf files).

Get the kit (9 USD)

Our own digital product, sold on Gumroad. The generator above stays free.

Frequently asked questions

Can I get a free WireGuard config?
The .conf file itself is free: this generator makes one in your browser. What a config cannot give you is a server. The free ready-made configs you find online (24-hour or 7-day accounts on shared servers) expire, and whoever runs that server sees every site you connect to. Free routes that stay under your control: an Oracle Cloud Always Free VM if your region has capacity, or Cloudflare WARP, which is free and built on WireGuard but runs on Cloudflare's network, not yours. Otherwise the cheapest server of your own is a small VPS (Contabo Cloud VPS 4, ~€5.50/mo, list price checked 17 October 2026): paste its IP above and the config is yours.
Are the generated keys secure?
Yes. Keys are generated in your browser using tweetnacl (Curve25519 / X25519), the same elliptic curve used by WireGuard. They are never sent to our servers - generation is 100% client-side.
What is the default port 51820?
51820/UDP is the unofficial default WireGuard port. You can change it to any port - 443 or 8443 can help bypass some firewalls. Just make sure to open the port on your server firewall (ufw allow 51820/udp).
Full tunnel vs split tunnel - which should I choose?
Full tunnel (0.0.0.0/0) routes all client traffic through the VPN - best for privacy and to bypass censorship. Split tunnel (10.0.0.0/24) only routes traffic destined to the VPN subnet - best for accessing internal resources without slowing down other traffic.
How many clients can I add?
WireGuard itself supports hundreds of peers. This generator creates up to 250 clients in one go, free and without an account, with a QR code per client and one ZIP holding every file.
What VPS do I need to run WireGuard?
Any Linux VPS works. WireGuard is lightweight - a 1 vCPU / 1 GB RAM server handles 50+ simultaneous tunnels easily. Contabo Cloud VPS 4 (4 vCPU, 8 GB RAM, ~€5.50/mo, list price checked 17 October 2026) is our recommended pick.

Your tunnel hides your IP. It does not hide your browser.

A correct WireGuard config replaces the address a site sees. It changes nothing about what your browser announces on its own, fonts, screen, time zone, graphics stack. That combination is often unique enough to follow you across sessions, tunnel or no tunnel.

Measure your own browser fingerprint - passive, no questions, no account, no email.