Back to Downloads

WireGuard config generator

Follow our WireGuard guides for step-by-step instructions on how to use WireGuard with Mullvad.

Key pair
Advanced settings

Kill switch (Linux only)


You can create and send as many new keys as you want but only the last five will be stored on our WireGuard servers and be allowed to connect. In other words, if you already have five active keys and create a new one, the oldest one will be replaced.

If you have any ports forwarded to your account, they will only be connected to the most recent key you've created.

Form field options

Key pair

In order to authenticate yourself to our WireGuard servers you need a key pair, which consists of a public and a private key. Choose from one of three options:

  • Generate new key pair will create a new pair in your browser. The public key will be sent to us so that we can assign an IP address to you and grant you access to the servers.
  • Reuse last key pair will simply reuse the last key pair that you generated in this browser session.
  • Custom key pair allows you to retrieve a key pair from a previous occasion by entering the private key.

The private key will never leave your device.

Server and Multihop server

Select which server location you want your configuration file to use.

To multihop, select a second server. Your outbound traffic will enter the first server, then be routed to the second before exiting to your destination.

Advanced settings – IP

Specify here if you only want to tunnel IPv4 or IPv6 addresses.

Advanced settings – Custom port

Select which port to connect to on the WireGuard server. Any port in the range 1-65535, except for ports 3000-3999 are available.

Advanced settings – Kill switch (Linux only)

Enabling this will ensure that no traffic is leaked outside of the tunnel if the connection to the server breaks.