Denis: Created page with "= WireGuard = == Key Management (wg) == The `wg` utility provides everything required to generate and manage WireGuard key material. === Generate a Private Key === Generate a new private key:

 wg genkey

Save it to a file:

 wg genkey > private.key

=== Derive a Public Key === A WireGuard public key is always derived from the private key. Generate the corresponding public key:

 wg pubkey < private.key

Save it:

 wg pubkey..."

2026-07-26T15:31:50Z

Created page with "= WireGuard = == Key Management (wg) == The `wg` utility provides everything required to generate and manage WireGuard key material. === Generate a Private Key === Generate a new private key: <pre> wg genkey </pre> Save it to a file: <pre> wg genkey > private.key </pre> === Derive a Public Key === A WireGuard public key is always derived from the private key. Generate the corresponding public key: <pre> wg pubkey < private.key </pre> Save it: <pre> wg pubkey..."

New page

= WireGuard =

== Key Management (wg) ==

The `wg` utility provides everything required to generate and manage WireGuard key material.

=== Generate a Private Key ===

Generate a new private key:

<pre>
wg genkey
</pre>

Save it to a file:

<pre>
wg genkey > private.key
</pre>

=== Derive a Public Key ===

A WireGuard public key is always derived from the private key.

Generate the corresponding public key:

<pre>
wg pubkey < private.key
</pre>

Save it:

<pre>
wg pubkey < private.key > public.key
</pre>

=== Generate a Key Pair ===

Generate both the private and public key in one command:

<pre>
wg genkey | tee private.key | wg pubkey > public.key
</pre>

=== Generate a Preshared Key (PSK) ===

Generate a new preshared key:

<pre>
wg genpsk
</pre>

Save it:

<pre>
wg genpsk > psk.key
</pre>

=== Notes ===

* Every WireGuard interface has a single '''private/public key pair'''.
* Every peer has its own '''public key'''.
* A '''PresharedKey''' is optional and unique per peer.
* Public keys are deterministic and can always be regenerated from the private key.
* Only the private key must remain secret.
* Public keys are safe to share.
* PSKs must be configured identically on both peers.

WireGuard - Revision history