b2KIT

WireGuard Config Generator

Generate WireGuard VPN configuration files with key pair generation and peer configuration.

Tested tool guide Tested browser tools Checked August 16, 2026

What WireGuard Config Generator does and how it behaves

This tool creates a Curve25519 private/public key pair, optionally a preshared key, and drops them into the [Interface] and [Peer] sections of a standard WireGuard .conf file alongside the address, endpoint, and AllowedIPs you supply. The part people get wrong: the public key you hand to the other side is mathematically derived from your private key, so if you regenerate keys after deploying a config, that peer's copy of your public key goes stale and the tunnel stops negotiating until both ends are updated together.

How the result is produced

1

Key pair generation

The tool generates 32 random bytes for the private key, clamps them per the Curve25519 convention (clearing and setting specific bits so the scalar is valid for X25519), and derives the public key by multiplying the curve's base point by that scalar. Both values are base64-encoded, matching the output format of the wg genkey / wg pubkey command-line tools.

2

Config file assembly

Your entered address, listen port, DNS, endpoint, AllowedIPs, and keepalive interval are inserted into a plain-text template with [Interface] and [Peer] headers. No values are validated against a live network - the tool only checks that fields are present and formatted (CIDR notation, host:port), not that the endpoint is reachable or the subnet is free.

Good uses

  • generating a client and server key pair for a new WireGuard tunnel without installing the wg command-line utility
  • producing a peer config block for an additional mobile or laptop client joining an existing WireGuard network
  • creating a preshared key to layer symmetric-key resistance on top of an existing tunnel's Curve25519 exchange

Limits and checks

  • the tool has no way to confirm your endpoint IP, port, or AllowedIPs actually match your router or firewall setup - it only formats what you typed
  • regenerating keys produces a completely new pair each time; the old public key stays valid on any peer that still has it configured until you update both sides
  • default DNS and AllowedIPs values (if the tool pre-fills any) are generic starting points, not a recommendation for your specific routing needs - review before deploying

Common questions

Are these keys the same format as wg genkey produces?

Yes. WireGuard keys are always 32-byte Curve25519 scalars or points, base64-encoded to 44 characters ending in '='. A key generated here is interchangeable with one from the official wg command-line tool - the underlying math is identical, only the implementation differs.

Does the private key ever leave my browser?

The generation itself runs client-side in JavaScript, so nothing is transmitted during key creation. That said, you are responsible for how you subsequently copy, paste, or store the private key - treat it like any other secret and don't paste it somewhere it could be logged.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools