piapia123
en

WireGuard Config Generator & Validator

Web

Everything runs locally in your browser — nothing is uploaded

Input
Drop a file here to load its contents
Output

Two modes. Generate: paste a private key (or create one with `crypto.getRandomValues`) and the tool derives the matching public key and assembles a ready-to-use client config — fill in the server key, endpoint, DNS and keepalive. Validate: paste a whole `.conf` and get a per-line verdict — is each key 32 bytes, is the port in 1–65535, is `AllowedIPs` valid CIDR, are peer keys duplicated, and the classic mistake of swapping `Address` and `AllowedIPs`. The public key is derived with X25519 (RFC 7748) implemented in plain JavaScript, not `crypto.subtle`, which only exists in a secure context (https); this is a static page and may be opened over http. The private key is shown as `<REDACTED>` and cannot be copied. Everything runs in your browser — nothing is uploaded.

Features

  • Two modes: build a config, or validate an existing .conf
  • Derive the public key from a private key (X25519, implemented locally)
  • One-click full [Interface] / [Peer] client config
  • Optionally generate a random private key with crypto.getRandomValues — never Math.random
  • The private key is redacted in the results to avoid screenshot leaks
  • Line-by-line validation: 32-byte keys, port ranges, valid CIDR for AllowedIPs
  • Detects duplicate peer keys and Address/AllowedIPs swapped by mistake
  • Runs entirely in your browser; nothing is uploaded

How to use

  1. Pick Generate or Validate
  2. Generate: paste a private key (or tick the random box) and fill in the server key, endpoint and options
  3. Copy the public key, or copy the whole config block
  4. Validate: paste a whole .conf and read the per-line verdicts

FAQ

Is my private key uploaded anywhere?
No. All derivation and validation happen in JavaScript inside your browser. The page makes no network request, so neither the private key nor the config leaves your device.
Why can I not see my private key in the results?
That row always shows <REDACTED> and cannot be copied, so a screenshot or a stray copy cannot leak it. It still appears inside the ready-to-use config below (PrivateKey = …) — treat that config as a secret and do not forward it.
Why implement the maths instead of using the browser crypto API?
Because crypto.subtle only exists in a secure context (https or localhost). This is a static page that may be opened over http or hosted on an internal IP, where crypto.subtle is not available at all. So X25519 (RFC 7748) is implemented in plain JavaScript, giving the same result everywhere.
What does Validate actually check?
That each key is 32-byte Base64, that the endpoint port is in 1–65535, that AllowedIPs and Address are valid CIDR, that peer public keys are not duplicated, and the common mistake of swapping Address and AllowedIPs — AllowedIPs belongs only in [Peer] and Address only in [Interface]. Each line gets its own verdict.

Related tools

CIDR Calculator

Web

Turn 192.168.1.0/24 into a network address, broadcast address, netmask, wildcard mask and usable host range. Runs in your browser.

Config Validator

Web

Check a package.json, .env, robots.txt, sitemap.xml or HTTP headers. Findings come in three levels — errors, warnings, suggestions — each with a reason.

Email config check

Web

Check a domain’s email setup: MX records, SPF’s DNS lookup count and terminator, the DMARC policy, and the DKIM key under a selector you name.

URL Parser

Web

Parse a URL into scheme, host, port, path, query parameters and fragment, with each parameter shown raw and decoded. Runs entirely in your browser.

User-Agent Parser

Web

Parse a user agent into browser, version, OS, device type and engine, and see which rules matched. Pattern matching only. Runs entirely in your browser.

HTTP Status Codes

Web

Look up an HTTP status code for its meaning, 1xx–5xx class, typical uses and common traps. Runs entirely in your browser.

← Back to all tools