WireGuard FAQ: free, Windows 11, and antivirus flags.

The Windows client is the WireGuardNT program, MIT licensed, and the installer checks the MSI signature and hash before running it. That is not a promise that every copy on the internet is clean. Install the version and size named on the download page, and do not run a build that does not match. A third-party audit before Linux 5.6 reported no vulnerabilities and did offer a defense-in-depth note.

Scanners sometimes flag the client after an update because the file hash changed. A May 2021 report described McAfee quarantining wireguard.exe, then dropping the exception on the next update. A support reply in that thread treated VPN clients as suspicious because they change the machine's route. A matching 1.1.1 file is a known class of false positive. A file with a different size is not.

Client 1.1.1 was tagged on 20 September 2026. The amd64 MSI and the x86 MSI are 3.3 MB each. The arm64 MSI is 2.9 MB. Some catalogs still list 0.5.3 from 23 December 2021, at about 2.8 to 2.9 MB. That is an older build.

No. WireGuard is tunnel software. The Windows app imports a configuration, brings up a tunnel interface, and exchanges encrypted UDP packets with a peer. It does not give you an exit node, an account, or a network to join.

No. The client has no login. The manager service encrypts imported configs to .conf.dpapi, limits them to Local System, and lets an administrator remove them. You can export them later from the window.

There is no paid support desk with the client. The Softonic catalog says the same about the project. The guides on this site cover handshake timeouts, the kill-switch, and antivirus quarantines. The Log tab and wireguard /dumplog are the diagnostic record on the PC.

Jason A. Donenfeld is the author named by the project and by the Softonic catalog. The Windows repository is MIT licensed. The Linux kernel implementation is distributed under the kernel GPL terms. This website is a reference for the Windows download. It is not a stand-in for those repositories.

Yes. The project lists Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025. The current Windows client is 1.1.1, tagged on 20 September 2026.

Yes. Server 2016, 2019, 2022, and 2025 are on the project install list, alongside Windows 10 and 11. Admins can deploy the MSI directly, including with Group Policy, and pass DO_NOT_LAUNCH if the window should not open after setup.

Yes. Version 1.1.1 publishes three MSIs: amd64 at 3.3 MB, x86 at 3.3 MB, and arm64 at 2.9 MB. The installer executable picks the MSI for the machine, checks its signature and hash, then runs it.

Packets travel as UDP. The usual listen port in examples is 51820, and a client can use another port. PersistentKeepalive defaults to 0. Set it to 25 only when a peer is behind NAT or a stateful firewall and must stay reachable after traffic goes quiet.

Yes. AllowedIPs, endpoints, and tunnel addresses can be IPv4, IPv6, or both. A full IPv6 route is ::/0. The split that avoids kill-switch rules is ::/1 and 8000::/1.

If a tunnel has one peer and that peer's AllowedIPs include 0.0.0.0/0 or ::/0, the Windows client turns on Block untunneled traffic. Those firewall rules stay in place so traffic does not leak onto the normal connection. Deactivate the tunnel to lift the block, or use the /1 routes if you want a default path without that behavior.

It is an optional symmetric secret mixed into the handshake, on top of the Curve25519 keys. The project documents it for people who want an extra symmetric layer. If your server did not give you one, leave the field empty. The no-key mode uses 32 zero bytes.

WireGuard authenticates peers with short public keys, uses one fixed Noise construction, and sends UDP. OpenVPN is built on TLS, can use certificates, and can run over TCP or UDP. The whitepaper puts the Linux implementation under 4,000 lines, excluding crypto primitives. The Softonic comparison puts OpenVPN near 100,000 lines.

The manager and tunnel services write to a shared ring buffer on the machine. The Log tab shows it. wireguard /dumplog prints it, and wireguard /dumplog /tail follows it. The log leaves the PC only if you save or redirect it.

Yes. Import tunnel(s) from file accepts a .conf file or a .zip of configs. Version 1.1.1 rejects duplicate tunnel names inside one import.

1.1.1 rejects a duplicate name in the same import. It also rejects reserved Windows names, with any extension. Rename the tunnel and import it again.

No. You are responsible for the traffic you put through the tunnel and for the network you join. The trust page states that limit. This site does not provide an exit node.