Windows client 1.1.1
WireGuard security, the MIT license, and your responsibility.
WireGuard is safe to discuss as tunnel software with a small, published design. It is not safe to describe as a free pass. The Windows client 1.1.1 is MIT licensed, the installer checks the MSI signature and hash, and you remain responsible for the traffic and the network you join.
Updated .
Legal use
Use WireGuard for traffic you are allowed to carry, on networks you are allowed to join. That includes a server you administer, a company network that issued you a config, and a router you own.
Do not use it to hide crime, to break into systems, to attack a network, or to move traffic you have no right to move. A tunnel encrypts packets. It does not change who is responsible for them.
This site does not operate a VPN service, an exit node, or a relay. The download is the Windows client. You bring the peer.
Ethical use
The ordinary jobs for this client are remote access to a network you belong to, a homelab, and keeping a session private on a network you do not trust, such as a cafe Wi-Fi. Those jobs still need a peer that is yours or that you were given.
Hiding the destination from the local network is not the same as hiding the activity from the law, from the peer's operator, or from the policy of the network you reach. If a peer operator logs, their log is theirs. The Windows client log is a local ring buffer, and it stays on the PC unless you export it.
Source and license
Jason A. Donenfeld is the author named by the project and by the Softonic catalog. The pieces do not share one license.
- Windows client
- The Windows repository states an MIT license. This is the WireGuardNT client, version 1.1.1.
- Linux kernel
- The in-tree implementation follows the kernel GPL terms. It has been there since Linux 5.6, released 29 March 2020.
- Whitepaper size
- The paper says the Linux implementation is under 4,000 lines, cryptographic primitives excluded, so a single person can review it.
- Audit
- A third-party audit before the 5.6 release reported no vulnerabilities. It did include a defense-in-depth suggestion. That is not a claim that every later build is beyond review.
- Installer check
- wireguard-installer.exe selects the MSI, checks the signature and the hash, then runs it. This site does not print a digest, because a digest has to be compared with the file you downloaded.
No-malware note
The client is not a disguised remote-access trojan. It is a VPN tunnel: it changes routes, adds an adapter, and installs a Windows service. Those actions are why some scanners flag VPN programs after each update. A May 2021 report described McAfee quarantining wireguard.exe, with the exception dropped when the next build changed the hash. A support comment in that thread said VPN software looked suspicious because it changes the connection.
A matching 1.1.1 file, 3.3 MB on amd64 or x86 and 2.9 MB on arm64, fits that false-positive class. A file that does not match the version or the size does not. Do not restore a mismatch. The December 2023 G Data report was about client 0.5.3, where ping worked and HTTP did not. That is a firewall clash, not a malware finding.
- Match 1.1.1 Compare version and size before you allow a quarantined file.
- Hash changes An exception list can forget the program on the next update.
- Local logs wireguard /dumplog reads the ring buffer on this PC.
- No account Nothing in the client asks you to sign in.
Your responsibility
You choose the peer, the AllowedIPs, and the traffic. You keep the private key. You decide whether Block untunneled traffic is what you want when a tunnel uses a /0 route. You check the file size against the download table.
wire-guard.org publishes those facts for the Windows client. It does not accept the legal burden of your traffic, and it does not provide a network to hide in. If you are unsure you are allowed to join a peer, do not import the config.