NordVPN WireGuard config generator

Everything happens in your browser

This is a static page with no server behind it. Your private key is never transmitted, stored, or logged — it never leaves this tab. You will never be asked for your NordVPN account token here. Step 2 shows you a command to run on your own machine instead.

1 Choose a server

Country

P2P servers only

Not every server permits torrenting.

2 Get your private key

Generate an access token at NordAccount → Generate access token, then run this on your own machine and paste the result below.

curl -s -u token:YOUR_TOKEN https://api.nordvpn.com/v1/users/services/credentials | jq -r .nordlynx_private_key

That token is a credential for your whole NordVPN account. Run the command yourself — never paste the token into a website, including this one. The key it returns is 44 characters and ends with =.

3 Options

Advanced — defaults are fine for normal use

Use NordVPN DNS 103.86.96.100, 103.86.99.100 Without this your existing resolver keeps seeing every domain you visit. Block IPv6 (add ::/0 to AllowedIPs) NordVPN carries no IPv6, so working IPv6 bypasses the tunnel. This black-holes it instead, at the cost of breaking IPv6-only sites. PersistentKeepalive = 25 Keeps the tunnel alive through NAT and stateful firewalls. Table = off Stops wg-quick installing any routes. Only for split tunnelling, where you manage ip rule yourself. Leave this off unless you know you need it — the tunnel will connect but route nothing.

Your country and these checkboxes are remembered in this browser. Your private key is never saved — see the README for why.

4 Your configuration

Choose a server and paste your private key.

The downloaded file contains your private key and lands in your Downloads folder readable by any process running as you. Lock it down as you move it:

sudo install -m 600 -o root -g root ~/Downloads/wg0.conf /etc/wireguard/wg0.conf
sudo wg-quick up wg0