Client 1.1.1

WireGuard features that ship in the protocol and the Windows client.

Cryptokey routing is the feature people meet first: a public key plus an AllowedIPs list. The handshake is Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s, with Curve25519, ChaCha20-Poly1305, and BLAKE2s. The Windows build that matches this page is 1.1.1, dated 20 September 2026.

Updated 1 November 2026.

Cryptography is one construction

The protocol page names a fixed set. There is no cipher menu. An optional pre-shared key mixes in an extra symmetric secret. When that key is absent, the construction uses 32 zero bytes. The handshake aims at perfect forward secrecy, identity hiding, and replay protection, and it avoids allocating session state for a packet that fails the mac1 check.

Primitives named by the project
Primitive	Role
ChaCha20-Poly1305	Authenticated encryption for packets, RFC 7539 construction.
XChaCha20-Poly1305	Used where the protocol asks for a random 24-byte nonce.
Curve25519	ECDH. Public keys are Curve25519 points.
BLAKE2s	Hash and keyed hash, RFC 7693.
SipHash24	Hashtable keys.
HKDF	Key derivation, RFC 5869.
Noise_IKpsk2	Handshake pattern. Construction string: Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s.

The whitepaper says the Linux implementation is under 4,000 lines, cryptographic primitives excluded, so one person can read it. A later public count of the kernel tree put the C files a bit over that once headers were included. Linux 5.6, released 29 March 2020, shipped the tunnel. A third-party audit before that release reported no vulnerabilities and added a defense-in-depth note.

Cryptokey routing

Each interface has a private key and a list of peers. Each peer has a public key and AllowedIPs. On send, the destination address selects the peer, the packet is encrypted to that public key, and UDP carries it to the peer's endpoint. On receive, the packet must decrypt for a known peer and the inner source must sit in that peer's AllowedIPs. Otherwise it is dropped.

That is why a firewall rule can often match "from this address, on this interface" and treat the packet as already authenticated. IPv4 and IPv6 can share one peer. The usual example listen port is 51820. Yours can be different.

Import a config that already has these fields

WireGuard for Windows Tunnels tab with one tunnel Active, a Deactivate button, peer Allowed IPs, a latest handshake, and transfer totals — Tunnels tab with an Active tunnel, Deactivate, and a transfer count. Open the image to inspect it.

Windows client, WireGuardNT

The Windows repository describes this client as the official way to run WireGuard on Windows. It uses WireGuardNT. The manager service, WireGuardManager, owns the tray UI. Each tunnel is a separate service named WireGuardTunnel$ and the config name.

Import accepts a .conf file or a .zip. Version 1.1.1 rejects duplicate names in one import. The manager watches the configurations folder, encrypts a new file to .conf.dpapi with CryptProtectData, limits it to Local System, and deletes the plaintext copy. Export from the UI writes the configs back out.

One peer with AllowedIPs 0.0.0.0/0 or ::/0 enables Block untunneled traffic. The /1 routes skip that firewall behavior. The editor has a checkbox for it. Steps if the network goes quiet

WireGuard

Add Tunnel, Edit, and Deactivate on an Active tunnel. Open the image to inspect it.

Commands documented for administrators
Command	What it does
wireguard /installtunnelservice path.conf	Creates WireGuardTunnel$ and the config name.
wireguard /uninstalltunnelservice name	Removes that tunnel service.
wireguard /installmanagerservice	Installs WireGuardManager for the tray UI.
wireguard /dumplog	Prints the shared ring log. Add /tail to follow it.
wireguard /update	Runs the updater. The UI can do this too.
wireguard /removedriver	Removes the adapter driver when no tunnel adapter remains.

PreUp, PostUp, PreDown, and PostDown run only when the admin registry key that allows them is set. A .conf.dpapi file needs Local System or an administrator for wg show.

Where the same tunnel runs

Install paths named by the project
System	What you install	Note
Windows 10, 11, Server 2016 through 2025	MSI or the installer that fetches it	Client 1.1.1. amd64 and x86 are 3.3 MB. arm64 is 2.9 MB. MIT.
Linux	Kernel module since 5.6, plus wireguard-tools	In tree from 29 March 2020. Distros package the tools. GPL terms of the kernel build.
macOS	App Store client, or wireguard-tools from Homebrew or MacPorts	The tools path is a command-line tunnel, not the Windows MSI.
Android and iOS	Store apps. Android also has a direct APK.	Phones can import a QR code. The Windows client imports a file instead.
FreeBSD, OpenBSD	Package wireguard or wireguard-tools	Listed on the project install page with the other systems.

This site's files are the Windows MSIs. Other systems use their own packages. Windows version, size, and requirements

Roaming, keepalive, containers

Both sides send to the newest endpoint that produced an authenticated packet. A laptop can change networks without a new config. The server learns a client's endpoint from the first good packet, so the server config often has no Endpoint line for that peer.

PersistentKeepalive defaults to 0. Set 25 only if the peer sits behind NAT or a stateful firewall and must accept new sessions after the traffic goes quiet. The exact edit

On Linux, the interface uses the network namespace where it was created. You can move it into a container namespace so that container's only path out is the tunnel.

[Interface]
PrivateKey = (stays on the machine that owns it)
Address = 10.10.10.2/32

[Peer]
PublicKey = gN65BkIKy1eCE9pP1wdc8ROUtkHLF2PfAqYdyYBz6EA=
AllowedIPs = 10.10.10.230/32
Endpoint = 192.95.5.69:51820
PersistentKeepalive = 25

Published example addresses and a published example public key. Do not reuse the key. Leave PersistentKeepalive out when you do not need it.