WireGuard config generator
A website cannot be a VPN — browsers do not create tunnels. What you can do here in a couple of minutes is set up a real VPN on your own server: keys, wg0.conf, files and QR codes for phones and laptops, address and route checks and step-by-step setup.
Free, no sign-up
A website cannot be a VPN: browsers do not create tunnels. This tool prepares a real WireGuard VPN on your own server — files for the server and your devices.
The IP or domain clients reach the server at. Add a port after a colon if it differs from the port below.
Addresses inside the tunnel. A private range that does not clash with the clients’ home or office networks.
Empty means the first subnet address (10.8.0.1).
Comma-separated. Required for a full tunnel — otherwise lookups bypass the VPN.
Empty lets wg-quick choose (usually 1420). Lower it, e.g. to 1280, if sites hang over mobile data.
How it works
Server
Public address and port (51820/UDP by default), the tunnel subnet, optional IPv6 (ULA), client DNS, MTU and NAT for internet access — iptables or nftables for your outbound interface.
Clients
Up to 50 devices. Addresses are assigned from the subnet automatically without collisions, or set manually. Routing: all traffic through the VPN (0.0.0.0/0, ::/0) or selected networks only. PersistentKeepalive 25 for devices behind NAT and a PresharedKey per client.
Keys
X25519 keys are created in the browser like wg genkey: 32 random bytes from crypto.getRandomValues with clamped bits; the public key matches wg pubkey. If a client already has a key, enter only its public key.
Checks
Invalid and overlapping subnets, addresses outside the subnet and duplicates, repeated names and keys, the Endpoint and port, AllowedIPs overlapping between clients on the server, DNS, MTU, a full tunnel without NAT — each with a rule ID and a jump to the field.
Files
The server wg0.conf, a .conf per client, a QR code for the WireGuard phone app (shown only on request), a ZIP with every file and a README, and instructions for the server and each OS.
Standards
WireGuard protocol and keys
- Document
- WireGuard whitepaper (J. A. Donenfeld, NDSS 2017), wg(8)
File format, PostUp/PostDown, DNS, MTU
- Document
- wg-quick(8)
X25519 key exchange
- Document
- RFC 7748
Base64 key encoding
- Document
- RFC 4648 §4
IPv6 addressing and text form
- Document
- RFC 4291, RFC 5952
Private IPv4 networks and CGNAT
- Document
- RFC 1918, RFC 6598
IPv6 unique local addresses (ULA)
- Document
- RFC 4193
CIDR
- Document
- RFC 4632
QR code
- Document
- ISO/IEC 18004
WG-NET-001
- What is checked
- The IPv4 subnet is a valid CIDR with a /8–/30 mask
- Level
- error
WG-NET-002
- What is checked
- The subnet has no host bits set (10.8.0.5/24 → 10.8.0.0/24)
- Level
- warning
WG-NET-003
- What is checked
- The VPN subnet is private (RFC 1918 or 100.64.0.0/10)
- Level
- warning
WG-NET-004
- What is checked
- The IPv6 subnet is a valid CIDR with a /48–/120 mask
- Level
- error
WG-NET-005
- What is checked
- The IPv6 subnet is unique local (ULA, fc00::/7, RFC 4193)
- Level
- warning
WG-NET-006
- What is checked
- The IPv6 subnet fits every IPv4 subnet address
- Level
- error
WG-ADDR-001
- What is checked
- The server address is inside the subnet, not the network or broadcast address
- Level
- error
WG-ADDR-002
- What is checked
- A client address is inside the subnet, not the network or broadcast address
- Level
- error
WG-ADDR-003
- What is checked
- No duplicate addresses (clients and server)
- Level
- error
WG-POOL-001
- What is checked
- The subnet has enough addresses for every client
- Level
- error
WG-PEER-001
- What is checked
- Client names are unique
- Level
- error
WG-PEER-002
- What is checked
- Every client has a name
- Level
- error
WG-PEER-003
- What is checked
- There is at least one client
- Level
- warning
WG-KEY-001
- What is checked
- An entered public key is 32 bytes of base64 (44 characters)
- Level
- error
WG-KEY-002
- What is checked
- Public keys are unique
- Level
- error
WG-KEY-003
- What is checked
- The server key is set (generated, pasted, or its public key is known)
- Level
- error
WG-EP-001
- What is checked
- The server’s public address (Endpoint) is set
- Level
- error
WG-EP-002
- What is checked
- The Endpoint is a host name, IPv4 or IPv6 (with or without a port)
- Level
- error
WG-PORT-001
- What is checked
- The port is between 1 and 65535
- Level
- error
WG-IFACE-001
- What is checked
- The interface name is up to 15 characters [A-Za-z0-9_=+.-]
- Level
- error
WG-ROUTE-001
- What is checked
- Route networks are valid CIDRs
- Level
- error
WG-ROUTE-002
- What is checked
- Client AllowedIPs on the server do not overlap
- Level
- error
WG-ROUTE-003
- What is checked
- A split tunnel without extra networks reaches only the VPN subnet
- Level
- hint
WG-ROUTE-004
- What is checked
- Networks behind a client do not overlap the VPN subnet
- Level
- error
WG-ROUTE-005
- What is checked
- A split tunnel does not contain 0.0.0.0/0 or ::/0
- Level
- warning
WG-DNS-001
- What is checked
- DNS entries are IP addresses (or search domains)
- Level
- error
WG-DNS-002
- What is checked
- A DNS server is set for full-tunnel clients
- Level
- warning
WG-DNS-003
- What is checked
- A name in DNS becomes a search domain, not a server
- Level
- hint
WG-MTU-001
- What is checked
- MTU is between 1280 and 9000
- Level
- error
WG-MTU-002
- What is checked
- MTU is at most 1420 on a regular internet path (1500 − 80 header bytes)
- Level
- warning
WG-NAT-001
- What is checked
- NAT is enabled on the server for full-tunnel clients
- Level
- warning
WG-NAT-002
- What is checked
- The server’s outbound interface name is valid (eth0, ens3…)
- Level
- error
WG-KA-001
- What is checked
- Without PersistentKeepalive a client behind NAT may go idle
- Level
- hint
Browser support
- Only crypto.getRandomValues is required — available in every current browser, mobile included. X25519 runs in JavaScript (@noble/curves); no WebAssembly.
- The QR code and the ZIP are built in the browser; the WireGuard app on iOS and Android scans the QR straight from your computer screen.
Limitations
- The tool does not connect to your server and cannot check that the port is open or NAT works — sudo wg show does that after setup (look for “latest handshake”).
- The layout is a star: the server in the middle, clients around it. Client-to-client traffic goes through the server; meshes and multiple servers are not built here.
- NAT rules target Linux with iptables or nftables. If the server already has a firewall (ufw, firewalld, cloud rules), allow forwarding and the UDP port there too — the instructions cover it.
- Keys are regenerated after a page reload (they are deliberately not stored). Download the ZIP before closing the tab; for a running server use “Paste an existing private key” or “I only know the public key”.
Security and privacy
- Private keys and PresharedKeys are created on your device and live only in this tab’s memory: they are not stored in localStorage, not put in the page address and never sent to any server.
- The browser remembers settings only: addresses, ports, DNS, client names, routes and manually entered public keys.
- File previews hide keys until you press “Show keys”; the QR code contains the private key and appears only after a separate click.
- “Wipe keys” zeroes the key bytes in memory and replaces them with placeholders in the files. JavaScript cannot guarantee that string copies are erased — close the tab when you are done.
- Analytics receives only the fact of a download and categories (client count range, tunnel type, IPv6 yes/no) — no addresses, names or keys.
- The result reaches us only if you send a request yourself and keep the “Attach the result” box ticked — the form shows exactly what will be sent. Keys, passwords and tokens are never part of the summary.
Related tools
All tools · 40
Password and passphrase generatorPasswords, passphrases from English or Russian words, PINs and patterns from a cryptographic generator, exact entropy and crack times, and a check of your own password for common weaknesses.
SSH key generatorEd25519 and ECDSA P-256 in OpenSSH format with a passphrase (like ssh-keygen), SHA256/MD5 fingerprints and randomart, restricted authorized_keys, ~/.ssh/config and an inspector for any public key. Keys are generated on your device.
JWT decoder, verifier and builderDecode a token part by part, verify HS/RS/PS/ES/EdDSA signatures with a PEM, JWK or JWKS key, see expiry with a countdown, 16 security rules, and build test tokens.
CIDR subnet calculatorIPv4 and IPv6: mask, range and exact address count, a binary view with the network boundary, subnetting and VLSM, list merging, overlaps with an address map, reverse DNS zones.
Image compressor (WebP/AVIF)Drop images in — WebP, AVIF or JPEG by quality or a target size in KB, a 1:1 before/after slider, srcset and <picture>, batch ZIP. All in the browser.
Favicon and app icon generatorFrom an image, SVG or a letter → favicon.ico, favicon.svg with dark mode, PNGs in every size, apple-touch-icon, maskable, manifest and HTML; tab, iOS and Android previews — in one archive.Need a VPN for the team or server access without open ports?
Technical consulting: WireGuard for the office and remote staff, databases and admin panels reachable only through the VPN, a bastion and network segmentation. The first short call is free.
- The first short conversation is free — we choose the format
- NDA — yours or ours
- Pricing after a brief and an agreed scope