WireGuard config checker
Handshake never completes, connected but no traffic, works on Wi-Fi but not on mobile data? Paste the server wg0.conf or the client file and see, line by line, what wg-quick will refuse and what will quietly misroute your packets.
Runs in your browser. The file, and its keys, are never uploaded.
What it checks
- Keys
- Each PrivateKey, PublicKey and PresharedKey must be 44 base64 characters that decode to 32 bytes. A key cut by a terminal or a chat app fails here, and so does a private key pasted where the other side's public key goes.
- Unknown keys and sections
- wg-quick refuses the whole file on a single typo ("AllowdIPs", "[Peers]") or a key in the wrong section, such as Endpoint under [Interface].
- Overlapping AllowedIPs
- On a server, two peers whose AllowedIPs overlap fight over the same addresses: wg hands the range to the last peer loaded, the other one keeps its handshake but receives nothing. 10.8.0.2/24 instead of 10.8.0.2/32 is the usual cause.
- Duplicate peers
- The same PublicKey listed twice keeps only one entry, so one device can never connect.
- Endpoint
- A client needs Endpoint = host:port to start the handshake. An Endpoint on a private address (192.168.x.x, 10.x.x.x) only works from inside that network.
- MTU
- Above 1420 on a standard 1500 link, packets fragment once WireGuard adds its headers: sites load halfway, SSH stalls after login. Below 1280, IPv6 breaks.
- Leaks in full tunnel
- 0.0.0.0/0 without ::/0 lets IPv6 traffic bypass the tunnel. A full tunnel without a DNS line keeps sending lookups to the local resolver.
- Server hygiene
- Missing ListenPort (random port at each start), DNS on the server (it rewrites the server's own resolver), SaveConfig = true (hand edits overwritten), the NAT interface name in PostUp.
What it cannot see
A file can be perfect and the tunnel still down. The checker reads text; it does not know whether UDP port 51820 is open in your firewall or cloud security group, whether net.ipv4.ip_forward is on, or whether the client's PublicKey really matches the private key on the device. If the file passes, check those next, and run wg show on the server: a "latest handshake" line tells you the keys and the port are right.
Privacy
The check runs entirely in this page's JavaScript. The config, private keys included, is not sent anywhere; we only count that a check was run. If you choose to import the file into WireGuard Manager afterwards, it is sent then, over HTTPS, and the keys are stored encrypted (AES-256-GCM).