Beginner guide

Goal: your phone connects to your small cloud server through an encrypted tunnel (WireGuard), instead of using a commercial VPN subscription.

Words you will see

• VPS — a small virtual computer you rent in a data center (DigitalOcean, Vultr, etc.).
• Public IP — the internet address of that VPS (shown in the provider dashboard).
• Server config — the file that lives on the VPS.
• Client config / QR — the file for one phone or laptop.
• Private key — a secret. Never share screenshots of it.

What each field means

• Server public IP — where clients should connect. Must be your VPS IP.
• Listen port — usually leave 51820.
• VPN network (CIDR) — internal addresses; leave the default if unsure.
• DNS — which DNS servers clients use while connected; 1.1.1.1 is fine.
• Number of devices — how many phones/laptops need a file.
• Full tunnel — on = send all browsing through the VPN.
• Extra shared keys — optional hardening; skip on your first try.

What the buttons do

• Generate configs — creates server + client files (and QR codes).
• Generate again — brand new keys (use after a leak or lost phone).
• Copy / Download — put the text on the clipboard or save a .conf file.
• DigitalOcean / Vultr — open a cloud provider to rent a VPS (referral links may apply).

After you generate

1. Create a cheap VPS (1 GB RAM is enough).
2. Install WireGuard on it and paste the server file into /etc/wireguard/wg0.conf.
3. Start WireGuard and open UDP 51820 in the firewall.
4. On your phone, install the official WireGuard app and scan that device’s QR.

You may need to turn on IP forwarding and NAT on Linux so full‑tunnel internet works. The generator includes commented example lines — uncomment and fix the network interface name if needed.

Privacy note

Keys are created in your browser. This site does not receive them. See Privacy.

← Back to the generator