What this generates
WireGuard uses Curve25519 (specifically X25519) for its key exchange — the same elliptic curve used by SSH's Ed25519 keys, just applied to Diffie-Hellman rather than signatures. This tool generates a fresh key pair using the browser's native WebCrypto API, with the exact bit-clamping WireGuard's own wg genkey applies, so the output is a real, working key pair rather than an approximation.
Use "New server setup" when you're standing up WireGuard for the first time — it generates a fresh key pair for both the server and the client. Use "Add client to existing server" when you already have a running WireGuard server with its own key: paste that server's existing public key, and this tool only generates a new client key pair, so it never risks replacing your server's identity and breaking your other peers.
You get the client's full config file (ready to import into the WireGuard app), a QR code of that same config for scanning on mobile, a [Peer] block to append to the server's config for this client, and — in "New server setup" mode only — a server [Interface] block for the brand-new server itself.
Setting this up for the first time
If you're standing up a new WireGuard server: put the [Interface] block at the top of /etc/wireguard/wg0.conf on the server, append the [Peer] block below it, then bring the interface up with wg-quick up wg0. On the client, import the generated config directly into the WireGuard app — desktop clients accept the config file, mobile clients can scan the QR code instead of typing anything.
Adding another client to an existing server later just means generating a new client key pair, giving it its own tunnel address (like 10.8.0.3/32), and appending one more [Peer] block to the server's config — you don't need to touch the server's own keys or the existing peers.
Frequently asked questions
What is a WireGuard preshared key for?
An optional extra layer of symmetric security on top of the normal key exchange — an attacker would need to break both to compromise the tunnel.
Where do I put the server [Interface] block versus the [Peer] block?
[Interface] goes once at the top of the server's own config file. Each client gets its own [Peer] block appended below it.
Why does AllowedIPs differ between the client config and the server's peer block?
On the client it controls what traffic routes through the tunnel. On the server's peer block, it restricts which source address that specific peer is allowed to use.