WireGuard Key Pair Generator — Browser X25519 Keys
DeveloperA WireGuard key pair generator creates an X25519 key pair with the browser Web Crypto API and encodes it as WireGuard base64 private/public key strings.
What is it
WireGuard is a VPN protocol that uses Curve25519-family keys. This tool generates an X25519 pair in a browser secure context, then outputs `PrivateKey`, `PublicKey`, and optional `PresharedKey` values as base64 strings. Store private and preshared keys securely before adding them to configuration files.
WireGuard key = base64(raw 32-byte X25519 private/public key); preshared key = base64(32 random bytes)
How to use
- 1Choose whether to include a preshared key.
- 2Generate the WireGuard key values.
- 3Use PrivateKey on the local peer, register PublicKey on the remote peer, and never share the private key.
Reference
| Field | Meaning |
|---|---|
| PrivateKey | secret key placed in the local peer configuration |
| PublicKey | public key registered by the remote peer |
| PresharedKey | optional additional shared secret |
Sources & standards
- MDN Web Docs: Client-side web APIs - MDN Web Docs
- MDN Web Docs: Web Crypto API - MDN Web Docs
- WireGuard: Quick Start - WireGuard
FAQ
Are WireGuard keys sent to a server?
No. X25519 key generation and base64 encoding run only in your browser.
Can I send the generated private key to the other peer?
No. Keep PrivateKey only on the local peer. Send only PublicKey to the other side.
When should I use a preshared key?
Use it optionally between peers when you want an extra symmetric secret. If used, the same value must be configured on both peers.