WireGuard Config Helper
Build a wg-quick [Interface] and [Peer] configuration from validated fields, with key shape, endpoint, AllowedIPs, MTU, and keepalive checks.
This tool handles input and primary processing in your browser and is designed not to send the input to QuickKit’s server.
Avoid live production secrets; use dummy or masked data where possible. Data handling details
Configuration
Suggested path
Notes
How it works
Renders a wg-quick configuration file from structured fields. Everything stays in this page: nothing is uploaded, saved, put in the URL, or applied to an interface. Three deliberate limits. First, this tool does not generate keys. A WireGuard private key is long-lived secret material, so keys are only accepted as input and only checked for shape: 32 bytes of base64, which is 43 payload characters plus '='. Leaving the private key empty renders a <private key> placeholder, which is the safer way to build a config you will finish on the target host with wg genkey. Second, PreUp, PostUp, PreDown, and PostDown are not supported, because those keys run arbitrary shell commands. Third, no configuration is parsed back in. Field semantics that are easy to get wrong: Address is the interface's own address and keeps its host bits, so 10.9.0.2/24 stays as written, while a peer's AllowedIPs is a set of networks and is masked to the network address the way wg itself normalizes it. AllowedIPs also acts as the inbound filter, so a peer can only send from addresses inside it. An Endpoint needs host:port, and an IPv6 literal must be bracketed. PersistentKeepalive matters when this side is behind NAT and needs to keep the mapping open; 25 seconds is the usual value and 0 disables it. MTU is accepted between 1280 and 1500; 1420 is the common value for a 1500-byte IPv4 path. Verify the result against your WireGuard version before applying it.