Skip to content
Marvin's Toolbox.

WireGuard Config Generator

Build a complete WireGuard setup: one server and as many peers as you need. Keys, preshared keys and tunnel addresses are filled in for you, with full or split tunnel routing, DNS, NAT rules, a QR code per peer and a zip of every config.

Runs entirely in your browser. Nothing you put in here gets uploaded.

Next steps

Send this tool's output straight into another tool.

Text Case Converter

Convert text into every case at once: title case in the APA, AP, Chicago, MLA, Bluebook, AMA and NYT styles, sentence case, upper, lower, camelCase, snake_case, kebab-case and more.

textconverterdev

Word & Character Counter

Count words, characters, sentences, paragraphs, lines and more as you type, with estimated reading and speaking time.

text

Dedupe Lines

Remove duplicate lines from a list or text, keeping the first occurrence. Optionally ignore case and whitespace, or drop blank lines too.

textdev

Find and Replace

Replace text in two modes: plain find and replace all, or regular expressions with flag controls and capture group references like $1.

textdev

Text Diff

Compare two texts and see every added, removed and changed line highlighted, side by side or inline, with the changed words marked within each line. Ignore case, whitespace or blank lines, read a summary of how much changed, and export the result as a unified diff.

textdev

UUID Decoder

Paste a UUID to see what it carries: version, variant, and for time-based versions the exact timestamp, clock sequence and node. Also shows the raw bytes, the 128-bit integer and the URN form.

devuuid

Base64 Encoder & Decoder

Decode Base64 to text or encode text to Base64. Paste into the top box, read the result below, and flip the direction with one click. Handles Unicode correctly, reads URL-safe Base64, and shows binary payloads as a hex dump you can download.

devconvertertext

Number Base Converter

Convert numbers between binary, octal, decimal, hexadecimal and any base up to 36. Type into any field and the others update as you go. Handles huge integers without losing precision and accepts 0x, 0b and 0o prefixes.

devconvertercalculator

Scientific Notation Converter

Convert between scientific notation and full numbers as you type. Reads 1.23e5, 1.23 × 10^5 and plain numbers, shows the value written out, in normalized scientific notation and in engineering notation, and can round to any number of significant digits.

convertercalculator

About the WireGuard Config Generator Tool

This tool builds a whole WireGuard setup at once: the config for the server and one for every peer. Enter the host peers connect to, and the keys, tunnel addresses and routing are filled in for you, with each .conf file updating as you type.

Each peer can get a generated key pair, a private key you paste in, or just a public key when the device keeps its own. Peers get their tunnel addresses from the subnet automatically, and every file can be copied, downloaded or bundled into a zip, with a QR code per peer for the mobile apps.

What you can do

  • Generate a wg0.conf server config and matching peer configs
  • Generate WireGuard key pairs and preshared keys
  • Derive a WireGuard public key from a private key
  • Add a peer to a server using only its public key
  • Create a QR code for the WireGuard mobile app
  • Set up a full tunnel, a split tunnel or custom AllowedIPs per peer
  • Generate PostUp and PostDown NAT rules for iptables or nftables
  • Run a dual stack tunnel with IPv4 and IPv6 addresses
  • Let peers reach each other through the server
  • Download every config and QR code as one zip

How to use the WireGuard Config Generator

  1. 1Enter the public host name or IP address of the server, and adjust the port and tunnel subnet if you need to.
  2. 2Pick the firewall on the server and name its WAN interface, so the NAT rules match the machine.
  3. 3Add a peer for each device, then choose its keys, routing and keepalive.
  4. 4Fix anything listed under Export. Clicking a problem jumps to the field it belongs to.
  5. 5Download the files, copy the server config to /etc/wireguard/ and start it with wg-quick up wg0. Scan the QR code on phones.

Full tunnel or split tunnel

AllowedIPs on a peer decides which traffic enters the tunnel. A full tunnel uses 0.0.0.0/0 and ::/0, so everything goes through the server, which then needs NAT to reach the internet. IPv6 is included even on an IPv4 only server, so that IPv6 traffic can't slip past the tunnel. A split tunnel only sends traffic for the tunnel subnet. The custom option takes your own list of CIDRs, for example the subnet plus a LAN behind the server.

The server side works differently. There, AllowedIPs says which addresses a peer may use, so each peer gets only its own tunnel address. Use the IP Subnet Calculator to size the subnet if you are planning for many peers.

How the keys work

WireGuard keys are Curve25519 key pairs written as 44 characters of base64. The private key comes from your browser's cryptographic random generator and is clamped the same way wg genkey does it, and the public key is derived from it the way wg pubkey does. A preshared key is an optional extra secret shared by the server and one peer, which adds a symmetric layer on top of the key exchange.

If a device should keep its private key to itself, pick the option for a peer that keeps its key and paste its public key. The server config is complete in that case, and the peer's file carries a marked placeholder for the private key. The same option exists for the server, for adding peers to a tunnel that is already running.

Keys stay out of storage

Nothing here is saved, so a reload starts over with new keys. Download the files before you leave the page. Configs sent on to another tool, such as the QR Code Generator, carry a placeholder instead of private and preshared keys, because forwarded data passes through browser storage. Use the QR code on this page for anything you want to scan.

Related tools

Tools that share a tag with this one.

ASN.1 and PKCS#12 Inspector

Decode any DER or PEM data into a browsable ASN.1 tree with named object identifiers and a linked hex view. Open PKCS#12 .p12 and .pfx bundles with their password to list the certificates and keys inside, and export them as PEM.

securitydev

Bcrypt & Argon2 Generator

Hash a password with bcrypt or Argon2 and verify a password against an existing hash. Tune the cost factor, memory, iterations and parallelism, see how long the hash takes, and read the parsed parts of any hash you paste.

securitydev

Checksum Validator

Verify a file against its checksum. Drop the file and paste the expected hash or a sha256sum line, and the hash type is detected for you, from MD5 to BLAKE3.

devsecurity

Config Converter

Convert config and data between JSON, YAML, TOML, JSON5, INI, XML, CSV and .env. Type or paste on the left, pick the output format on the right, and copy the result. Includes a format button and a minify toggle.

devconverterconfigjsonyaml

CSP Builder

Build a Content-Security-Policy header directive by directive, or paste an existing policy to check it. Weak spots like unsafe-inline, wildcards and missing directives are flagged with what to do instead.

securitydev

CSR Generator

Create a certificate signing request with a fresh RSA or ECDSA key or your own. Fill in the subject and subject alternative names, then download the CSR and private key as PEM, with the matching openssl command alongside.

securitydev