WireGuard Config Generator

Plan a WireGuard server and its clients in one go: the server’s wg0.conf with a [Peer] block per client, and a ready .conf file and QR code for every phone, laptop or router. Keys are created in your browser and never leave this page.

Every client config and QR code contains that device’s private key, and the server’s wg0.conf contains the server’s. Anyone who gets one can connect as that device. Scan QR codes straight from this screen, move files over a channel you trust, and delete downloaded copies once they are imported.

Server

Interface name

The file becomes /etc/wireguard/<name>.conf.

Listen port (UDP)

Public endpoint

The public IP or DNS name clients connect to, optionally with a port if your router forwards a different one. IPv6 goes in brackets: [2001:db8::1]:51820.

Server key

Generate here Paste public key safer

Server public key

Create the key on the server and paste only the public key it prints. The command saves the private key with owner-only permissions:

Tunnel addresses

IPv4 network

A private range that isn’t used on your LAN or on the networks your clients join. The server takes the first address, peers get the next ones; the network and broadcast addresses are skipped.

Choose addresses server address, first peer address

Server address

First peer address

Set the first peer address when you add clients to a server that already has some, so the new ones don’t reuse taken addresses.

Add IPv6 addresses Each peer also gets a /128 from an IPv6 network, with the same host number as its IPv4 address.

IPv6 network

A unique local (ULA) prefix from fd00::/8 with a random 40-bit ID, as RFC 4193 describes, or a routed prefix from your ISP.

Client settings

What goes through the tunnel

Everything (full tunnel) Only some networks (split)

Clients send all traffic to the server: AllowedIPs = 0.0.0.0/0. wg-quick then routes the default route through the tunnel.

Also send IPv6 into the tunnel (::/0)

Networks behind the server

Comma-separated, for example your home LAN. The tunnel network itself is always added, so clients reach the server and each other.

DNS servers optional

Comma-separated IP addresses; a name such as home.lan becomes a search domain. Use the server’s tunnel address only if it runs a DNS resolver (Pi-hole, AdGuard Home, Unbound). Empty: clients keep the DNS of the network they are on.

Persistent keepalive

MTU optional

Keepalive is for clients behind NAT that must stay reachable while idle; most setups don’t need it. MTU applies to the server and every client. Left empty, wg-quick uses the outgoing link’s MTU minus 80 (1420 on a normal 1500-byte link) and the Android and iOS apps use 1280.

Add a preshared key per peer A separate random 32-byte key for each server ↔ client pair, mixed into the handshake for post-quantum resistance (wg(8)). The same key goes into both configs.

Peers (clients)

Name each device. Generate key gives you a complete config and QR code. Paste public key is for a device that created its own key (the app’s Create from scratch, or wg genkey on a laptop): its private key never leaves the device, and you type the settings into it by hand.

Server extras example

Add NAT and forwarding rules to wg0.conf iptables commands in PostUp / PostDown, so clients can reach the internet or your LAN through the server. An example to check against your firewall, not a full firewall setup.

Server’s outgoing interface

The name after dev in ip route show default on the server, for example eth0, ens18 or vmbr0. The server needs the iptables command: if a PostUp command fails, wg-quick takes the interface down again.

Checking the browser’s X25519 support…

Fix the errors above to see the configs.

Keys are hidden on screen only; Copy, Download and the QR codes always contain the real keys. They exist only in this tab, so download what you need before you reload or close it.

S Server

/etc/wireguard/wg0.conf

Public key

This file contains the placeholder PASTE_SERVER_PRIVATE_KEY_HERE. Replace it with the server’s private key (sudo cat /etc/wireguard/server.key on the server) — or, if WireGuard already runs there, append only the [Peer] blocks below to your existing config.

Only the [Peer] blocks to add clients to a running server

Append them to the server’s config file, then apply them without dropping connected clients: sudo systemctl reload wg-quick@wg0 (the unit runs wg syncconf on wg-quick strip).

Server setup steps example commands for Linux with systemd

Copied

This free WireGuard VPN config generator builds a whole setup in one place: the server’s wg0.conf with a [Peer] block for every client, plus a ready .conf file and QR code for each phone, laptop or router. Every key is created in your browser and never leaves the page.

It is made for homelab owners who want remote access without copying keys between terminals.

What This WireGuard VPN Config Generator Does

You describe the server and name your devices, and the WireGuard VPN config generator writes every config that belongs to that plan.

Keys made in your browser: X25519 key pairs from the browser’s WebCrypto, clamped like wg genkey, plus an optional preshared key per client
Address plan: the server takes the first tunnel address, each client the next one as a /32, with optional IPv6 from a random ULA prefix
Full or split tunnel: send everything through the VPN or only your LAN and the tunnel network
Client settings: DNS, PersistentKeepalive (off by default, 25 seconds for clients behind NAT), MTU, and a different public port if your router forwards one
Server config: wg0.conf with all [Peer] blocks, the blocks on their own for a running server, an optional iptables NAT example, and setup steps
Per-client output: a .conf download and a QR code for the WireGuard app, or one ZIP with every config
Checks as you type: a tunnel network that is too small, duplicate or mistyped keys, and DNS servers the tunnel can’t reach

How to Use the WireGuard VPN Config Generator

Enter the server’s public IP address or DNS name and its UDP port (51820 by default).
Pick the tunnel network, and turn on IPv6 if you want it.
Choose full or split tunnel; add DNS, keepalive or MTU only if you need them.
Name one peer per device. Keep Generate key, or choose Paste public key for a device that made its own key.
Put wg0.conf on the server, then scan each QR code in the WireGuard app: tap +, then Scan from QR code on Android or Create from QR code on iPhone.

The WireGuard VPN config generator updates every config as you type. Download what you need before you reload the page: the keys exist only in that browser tab.

Keys, QR Codes and What Stays Private 🔐

How the keys are made

WireGuard keys are 32 bytes of X25519 data, written as 44 characters of base64. The WireGuard VPN config generator asks the browser’s WebCrypto API for each key pair and clamps the private key the way wg genkey does. Before it creates a key, it checks its X25519 engine against the test vector in RFC 7748. Browsers without X25519 in WebCrypto get the audited TweetNaCl.js library instead. Preshared keys are 32 random bytes from crypto.getRandomValues, like wg genpsk.

Why pasting a public key is the safer option

Every client config and QR code contains that device’s private key, and wg0.conf contains the server’s. The safest private key never leaves its device, so run this on the server and paste only the public key it prints:

sudo sh -c 'umask 077; mkdir -p /etc/wireguard; wg genkey | tee /etc/wireguard/server.key | wg pubkey'

The WireGuard VPN config generator then writes a placeholder instead of the server’s private key, and you add only the new [Peer] blocks. A device that made its own key with Create from scratch in the app works the same way, just without a QR code.

What goes into the QR code

The official WireGuard apps read the plain text of a client config from the QR code; both even suggest qrencode -t ansiutf8 < tunnel.conf to make one. This WireGuard VPN config generator only writes settings those apps accept, checks that the text fits into a QR code, and loads its QR library with a pinned integrity hash. There is no QR image download on purpose: a saved picture is one more copy of the key.

Full tunnel and IPv6 leaks

According to the WireGuard project, AllowedIPs acts like a routing table when sending and like an access list when receiving, so the WireGuard VPN config generator gives every client a single /32 on the server. A full tunnel includes ::/0 even without IPv6 on the tunnel: IPv6 traffic then goes into the tunnel, where it is dropped, instead of leaving the device outside the VPN.

Practical Use Cases

These are the situations where a WireGuard VPN config generator saves the most typing:

🏠 Remote access to your homelab: reach Proxmox, a NAS or Home Assistant from anywhere. My comparison of secure remote access options for a home server shows where WireGuard fits.
📱 Phones and tablets in one scan: create configs for the whole family and scan each code from the screen.
🧩 New peers on a running server: set the first peer address after the ones in use, paste the server’s public key, and append the new blocks. A systemctl reload applies them without disconnecting anyone.
🖥️ Checking a dashboard’s output: if you run WireGuard with a web UI, as in my guide to self-hosting WireGuard on Proxmox in minutes, the WireGuard VPN config generator shows what a correct client config looks like.
🛜 OpenWrt routers: whether you are setting up Wi-Fi 6 and Wi-Fi 7 on OpenWrt or installing OpenWrt to a router’s eMMC, an always-on router makes a good WireGuard server: copy the keys and addresses into its WireGuard interface.

Planning a bigger tunnel network? Check its size with the IP Subnet Calculator.

Privacy, Ads, and Data Policy

A VPN config is a set of keys to your network, so this WireGuard VPN config generator keeps them on your device:

✅ 100% free: no registration, no account, no usage limits
✅ No data storage: private and preshared keys stay in the page’s memory, never in cookies, local storage or the page URL; Copy link shares settings only
✅ No ads in results: no watermarks, tracking links or extra lines in your configs and QR codes
✅ Client-side only: nothing you enter is sent anywhere; the only requests load the QR library when you open a QR code, and TweetNaCl.js in browsers without X25519

Open Source and Self-Hosting

The WireGuard VPN config generator is open source in the vahac-tools repository on GitHub, next to every other tool on this site. It is one folder with three files, so you can host it yourself or open it from disk.

Its two optional dependencies load from a CDN with a pinned integrity hash: the MIT-licensed qrcode-generator library, the same one behind the Wi-Fi QR Code Generator, and TweetNaCl.js as a fallback. Forks and pull requests are welcome.

Looking for more utilities like this? Browse the full list on the Tools page.

Built by VahaC — 100% client-side, no data sent anywhere.