WireGuard key generator

Generate a single WireGuard key pair (Curve25519) right in your browser. Nothing is sent to any server.

How to use the wireguard key generator

  1. Press Generate key pair.
  2. Copy the public key to share with your server.
  3. Keep the private key on your device — never share it.

About WireGuard keys

WireGuard uses Curve25519 key pairs. The private key signs your tunnel and must stay on your device; the public key is what you hand to the server. These are generated locally in your browser and never transmitted. Give every device its own key pair so you can revoke one without touching the others. Need a full config too? Use the config generator.

Code & API examples

Use this from the command line or your code.

wg CLI
wg genkey | tee private.key | wg pubkey > public.key

See all endpoints at /api/tools/.

Frequently asked questions

Curve25519 key pairs. The private key signs your tunnel and stays on your device; the public key is shared with the server.

You shouldn't. Each device should have its own key pair so you can revoke one without affecting the others.
Related tools
WireGuard config generator WireGuard preshared key generator Hash generator (SHA-256 & more)
Want to hide your IP for real?

vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.

Step up to the tee — free