WireGuard key generator
Generate a single WireGuard key pair (Curve25519) right in your browser. Nothing is sent to any server.
How to use the wireguard key generator
- Press Generate key pair.
- Copy the public key to share with your server.
- Keep the private key on your device — never share it.
About WireGuard keys
WireGuard uses Curve25519 key pairs. The private key signs your tunnel and must stay on your device; the public key is what you hand to the server. These are generated locally in your browser and never transmitted. Give every device its own key pair so you can revoke one without touching the others. Need a full config too? Use the config generator.
Code & API examples
Use this from the command line or your code.
wg CLI
wg genkey | tee private.key | wg pubkey > public.keySee all endpoints at /api/tools/.
Frequently asked questions
Curve25519 key pairs. The private key signs your tunnel and stays on your device; the public key is shared with the server. There are no certificates or central authority involved.
You shouldn't. Each device should have its own key pair so you can revoke one without affecting the others, and so the server can meter and identify peers individually.
This tool uses the WebCrypto/tweetnacl Curve25519 implementation to create the pair locally. The private key is computed on your device and is never sent to vpn.golf or any server.
The private key is a secret you keep; the public key is derived from it and safe to share. The server only needs your public key to recognize your tunnel — it never needs the private one.
Both keys are 32 bytes, shown as a 44-character base64 string ending in '='. If a key is a different length, it was generated or copied incorrectly.
Yes — the public key is deterministically derived from the private key via Curve25519. Run 'echo PRIVATE | wg pubkey' with the wg CLI, or paste the private key here to recompute the pair.
Anyone with it can impersonate your device on the tunnel. Generate a new key pair, update the server with the new public key, and revoke the old one immediately.
No. Keys don't have a built-in expiry, so they work until you rotate or revoke them. Rotating periodically — or whenever a device is lost — is good hygiene rather than a requirement.
Because each click creates a fresh random private key, and the public key is derived from it. If you want a stable pair, generate once and save both values; don't regenerate.
The keys are created in memory in your browser, but a shared or untrusted machine could have malware or clipboard loggers. For anything sensitive, generate keys on a device you control.
Keep it in the WireGuard config on the device, or in a password manager. Don't email it, commit it to a repo, or paste it into chat — treat it like a password.
Not necessarily — one device key pair can connect to multiple servers that all know its public key. But a separate pair per device is what matters for revocation, not a pair per server.
Related tools
Want to hide your IP for real?
vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.
Step up to the tee — free