wg set peer preshared-key: add a WireGuard preshared key for post-quantum resistance

Q: Must both peers use the same preshared key?

Yes. The preshared key is symmetric: the same value must be configured for this peer on both ends, otherwise the handshake fails and the peers never connect.

Q: How do I remove a preshared key again?

Pass /dev/null or another empty file as the preshared-key file. The manual states that this removes the key from the device.

updated 2026-10-24

tool: WireGuard
command: wg set
flag: peer KEY preshared-key FILE
default: no preshared key (the handshake uses only the public-key cryptography)

sudo wg set wg0 peer 'PEER_PUBLIC_KEY=' preshared-key /etc/wireguard/peer1.psk adds a preshared key to that peer on the running interface. The wg(8) manual describes it as optional, adding "an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance". The key is a random 256-bit value generated with wg genpsk, shared between exactly the two peers, and configured on both sides. In configuration files it is the PresharedKey line of the [Peer] section.

Generate and apply

bash

umask 077
wg genpsk > peer1.psk                                            # 32 random bytes, base64
sudo wg set wg0 peer 'PEER_PUBLIC_KEY=' preshared-key ./peer1.psk
sudo wg show wg0 preshared-keys                                  # confirm (prints the key)
sudo wg set wg0 peer 'PEER_PUBLIC_KEY=' preshared-key /dev/null  # remove it again

On the other peer, put the same value in its configuration:

client wg0.conf

[Peer]
PublicKey = SERVER_PUBLIC_KEY=
PresharedKey = CONTENT_OF_peer1.psk=
AllowedIPs = 10.0.0.0/24
Endpoint = vpn.example.org:51820

Why use one

WireGuard's handshake relies on Curve25519. A preshared key mixed into the handshake means that an attacker who records traffic today and later gains a quantum computer able to break Curve25519 still cannot decrypt the sessions without also knowing the symmetric key. It costs nothing in performance; the effort is distributing one more secret per peer pair.

Item	Scope	Command
Private key	One per interface	wg genkey
Public key	Derived from the private key, shared with peers	wg pubkey
Preshared key	One per pair of peers, identical on both sides	wg genpsk

Key generation is covered in detail on wg genkey.

Pitfalls

Both sides must match. A preshared key on only one end, or a different value, makes the handshake fail silently: latest-handshake stays at 0 in wg show dump.
Runtime only. Like every wg set change, it is not written to the configuration file; add PresharedKey to the file or run wg-quick save.
Unique per pair. Reusing one preshared key for all peers weakens the benefit; generate one per peer.
Removing peers is done with wg set ... remove, and adding new ones without a restart on add a peer without restarting.

FAQ

Why does wg want a file instead of the key itself?

The manual explains that command-line arguments are not considered private on most systems, so private-key and preshared-key take file paths. In bash, <(echo KEY) passes a string without writing a file.

Must both peers use the same preshared key?