WireGuard key & config generator

Key pairs and ready-to-use configs for both ends of a tunnel, made in your browser – keys never leave it.

Keys are generated in your browser with a cryptographically secure random source. Nothing is sent to the server.

Server endpoint (public host name or IP)

Listen port (UDP)

Server tunnel addresses

Client tunnel addresses

Routes through the tunnel (client AllowedIPs)

0.0.0.0/0, ::/0 sends all traffic through the tunnel; list subnets for a split tunnel.

Client DNS (optional)

Add a pre-shared key (extra post-quantum protection layer)

Public key

Public key