wg genkey | tee privatekey | wg pubkey > publickey: generate WireGuard keys

wg genkey prints a new random private key (32 bytes, base64-encoded: 44 characters ending in =), and wg pubkey reads a private key on standard input and prints the matching public key. The usual one-liner writes both files at once: umask 077; wg genkey | tee privatekey | wg pubkey > publickey. The private key goes into your own [Interface] PrivateKey; the public key is what you give to the peer for its [Peer] PublicKey.

Generate a key pair

umask 077                                   # new files readable by the owner only
wg genkey | tee privatekey | wg pubkey > publickey
cat publickey

wg warns Warning: writing to world accessible file. when the umask would let other users read the private key; umask 077 prevents that.

For a server, keep the keys next to the configuration:

sudo sh -c 'umask 077; wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub'

Optional pre-shared key

wg genpsk > peer1.psk

A pre-shared key adds a symmetric secret to the handshake (PresharedKey = in the [Peer] section on both sides), as an extra layer against future attacks on Curve25519. Use one per peer pair.

Use them in the configuration

# Server /etc/wireguard/wg0.conf
[Interface]
PrivateKey = <contents of server.key>
Address = 10.0.0.1/24
ListenPort = 51820

[Peer]
PublicKey = <contents of the client's publickey>
AllowedIPs = 10.0.0.2/32

Each side has its own private key and lists the other side's public key. A public key never needs to be secret; a private key never leaves the machine it belongs to.

Other ways