WireGuard preshared key generator
A WireGuard preshared key adds a symmetric layer on top of the normal key exchange, hardening the tunnel against future attacks. Generated locally here.
How to use the wireguard preshared key generator
- Press Generate preshared key.
- Copy the value into both peers' configs under PresharedKey.
- Both ends must use the same key.
What a preshared key does
A WireGuard preshared key is an optional 32-byte symmetric secret added on top of the normal public-key handshake. It hardens the tunnel with defense-in-depth — including resistance against potential future quantum attacks on the key exchange. Put the same value in both peers' configs under PresharedKey. It's generated here with your browser's secure random source and never sent anywhere.
Code & API examples
Use this from the command line or your code.
wg CLI
wg genpskSee all endpoints at /api/tools/.
Frequently asked questions
It's optional. It adds defense-in-depth — a shared symmetric secret mixed into the handshake that strengthens it, including against potential future quantum attacks on the Curve25519 exchange.
In both peers' configs under PresharedKey, inside the [Peer] section. Both sides must use the exact same value or the handshake fails.
The private key is asymmetric and unique per device; the preshared key is a symmetric secret shared by both peers. They serve different roles, and using a PSK doesn't replace having key pairs.
It's 32 bytes of randomness, displayed as a 44-character base64 string — the same format as a regular WireGuard key. The difference is how it's used, not how it looks.
Curve25519 could in theory be broken by a future quantum computer, exposing past handshakes. Mixing in a symmetric PSK that a quantum adversary can't derive keeps the session secret even if the elliptic-curve part is broken.
You can, but using a unique PSK per peer pair is stronger — it limits the blast radius if one is exposed. Each tunnel between two specific peers should ideally have its own.
Almost always a mismatch: the two ends have different PresharedKey values, or only one side set it. Both peers must carry the identical key, or remove it from both.
Yes — this tool produces it from your browser's cryptographic random source locally. It's never transmitted, so you can copy it into both configs yourself.
No. WireGuard always encrypts with the Curve25519-derived keys; the PSK is an additional symmetric layer folded into the key derivation, not a substitute for the normal handshake.
Generate a new PSK and update both peers' configs at the same time, then restart the tunnel. Because both ends must match, plan the swap so neither side is left on the old value.
No. Once both peers require a PSK, a handshake without the matching key is rejected, so a leaked public key alone isn't enough to establish a tunnel.
Only the operational cost: you have a second secret to distribute and keep in sync across both peers. There's no meaningful performance or security drawback to enabling it.
Want to hide your IP for real?
vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.
Step up to the tee — free