Keys for every peer
Every WireGuard interface needs a Curve25519 key pair: the private key goes in its own [Interface] section, and the public key goes in the [Peer] section on the other side. This generator creates X25519 pairs with the Web Crypto API and prints them in Base64, exactly like wg genkey and wg pubkey.
Setting up a hub with many clients? Raise the count to create several pairs at once. Turn on the preshared key option for an extra symmetric layer that WireGuard mixes into the handshake, which helps protect recorded traffic against future quantum attacks.
Where each key goes
[Interface]
PrivateKey = <this device's private key>
Address = 10.0.0.2/32
[Peer]
PublicKey = <the other device's public key>
PresharedKey = <shared by both sides, optional>
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0Frequently asked questions
Can I derive the public key from the private key later?
Yes. Save the private key to a file and run wg pubkey < private.key on any machine with the WireGuard tools installed.
Does each peer need its own preshared key?
Each pair of peers shares one preshared key, which both sides list in their [Peer] sections. Use a different one for every pair.