🛡️ WireGuard Config Generator
Generate WireGuard server and client configs with X25519 keypairs, QR code for mobile import.
Scan with the WireGuard mobile app → "+" → "Scan from QR code"
About this tool
This tool generates complete WireGuard configurations for a server and one client, with X25519 key pairs generated in your browser using the Web Crypto API. It produces ready-to-use wg0.conf files and a QR code you can scan with the WireGuard mobile app to add the client tunnel instantly.
WireGuard is a modern VPN protocol that is faster and simpler than OpenVPN or IPSec. It uses public-key cryptography for authentication and supports IPv4 and IPv6. The server acts as a gateway (with NAT/masquerading rules), and the client routes all or selective traffic through the tunnel.
Example: generate configs with a server endpoint at vpn.example.com:51820 and a client named "my-phone". You get a server config with iptables PostUp/PostDown rules and a client config you can copy, download as a .conf file, or scan via the QR code for instant mobile setup.
FAQ
How do I deploy the server config? ›
Save it as <code>/etc/wireguard/wg0.conf</code> on your Linux server and run <code>wg-quick up wg0</code>. Install the <code>wireguard-tools</code> package and enable IP forwarding with <code>sysctl net.ipv4.ip_forward=1</code>.
How do I use the QR code on my phone? ›
Open the WireGuard app (iOS or Android), tap "+", then "Scan from QR code", and point your camera at the QR code shown on this page. The entire client config is encoded in the QR.
What does PersistentKeepalive do? ›
It sends periodic keepalive packets every N seconds so the tunnel stays reachable through NAT/firewalls. Set it to 25 for mobile clients; set it to 0 (or leave blank) for always-connected servers behind the same NAT.
Do I need a pre-shared key? ›
The PSK adds an extra layer of post-quantum resistance via WireGuard's Triple Handshake. It is optional but recommended for production. Generate one with <code>wg genpsk</code> in a terminal and paste it here.