WireGuard Config Helper
Build a wg-quick [Interface] and [Peer] configuration from validated fields, with key shape, endpoint, AllowedIPs, MTU, and keepalive checks.
This tool handles input and primary processing in your browser and is designed not to send the input to QuickKit’s server.
Avoid live production secrets; use dummy or masked data where possible. Data handling details
Configuration
Suggested path
Notes
How it works
Renders a wg-quick configuration file from structured fields. Everything stays in this page: nothing is uploaded, saved, put in the URL, or applied to an interface.
Three deliberate limits. First, this tool does not generate keys. A WireGuard private key is long-lived secret material, so keys are only accepted as input and only checked for shape: 32 bytes of base64, which is 43 payload characters plus '='. Leaving the private key empty renders a <private key> placeholder, which is the safer way to build a config you will finish on the target host with wg genkey. Second, PreUp, PostUp, PreDown, and PostDown are not supported, because those keys run arbitrary shell commands. Third, no configuration is parsed back in.
Field semantics that are easy to get wrong: wg-quick takes the interface name from the file name, so the name must be 1 to 15 characters of letters, digits, and _ = + . - (wg-quick's own rule); '.' and '..' are also refused because Linux will not create them. An empty or blank name uses wg0. Any other name is used exactly as typed: spaces or line breaks around it are not removed, so ' wg0' is an error, and no invalid name is replaced. Passing this check means only that wg-quick accepts the name; it does not guarantee that every program around wg-quick on your system handles it. One known case is Linux wg-quick with a default route (0.0.0.0/0 or ::/0) in AllowedIPs: a name with + or = makes wg-quick up fail on a host with nft installed, and a name ending in + weakens the anti-spoofing rule of the iptables fallback used without nft. The notes show when this applies; a name such as wg0 avoids both.
Address is the interface's own address and keeps its host bits, so 10.9.0.2/24 stays as written, while a peer's AllowedIPs is a set of networks and is masked to the network address the way wg itself normalizes it. AllowedIPs also acts as the inbound filter, so a peer can only send from addresses inside it. An Endpoint needs host:port, and an IPv6 literal must be bracketed. PersistentKeepalive matters when this side is behind NAT and needs to keep the mapping open; 25 seconds is the usual value and 0 disables it. MTU is accepted between 1280 and 1500; 1420 is the common value for a 1500-byte IPv4 path.
Verify the result against your WireGuard version before applying it.