Is WireGuard free? What actually costs money

Is WireGuard free?

Yes. WireGuard is free, open-source software, and nobody sells a licence for it. The kernel module, the wg tools and the official apps cost nothing to download and run. What can cost money is the machine at the far end of the tunnel, and the person or company that runs it.

The project's own donations page says it plainly: donations "enable us to continue developing WireGuard as free open source software." The rest of this guide explains which licence covers each piece, why your keys are free, what a "free WireGuard config" from a website really gives you, and when paying for the other end makes sense. It is an explainer. If you want to build the server, go to the full guide to self-hosting a WireGuard VPN on your VPS.

Which licence covers each part of WireGuard?

WireGuard is not one program. It is a protocol plus several implementations, and they do not share one licence. The wireguard.com homepage says only that "The kernel components are released under the GPLv2, as is the Linux kernel itself" and that "Other projects are licensed under MIT, BSD, Apache 2.0, or GPL, depending on context." So the reliable source is the COPYING file in each repository, or the licence tag in the source file itself. Here is what those files say, as of October 2026:

• The in-kernel module. The file drivers/net/wireguard/main.c in the Linux source tree carries SPDX-License-Identifier: GPL-2.0 and MODULE_LICENSE("GPL v2"). This is the code that does the actual tunnelling on a Linux server.
• wireguard-tools, which holds the wg and wg-quick programs. Its COPYING file is the text of the GNU General Public License, version 2.
• wireguard-windows, the Windows client. Its COPYING file holds the standard MIT permission text. The file does not print the name "MIT", but the wording is the MIT licence.
• wireguard-android, the Android client. Its COPYING file is the Apache License, version 2.0.
• wireguard-apple, the client for iOS and macOS. Its COPYING file also holds the standard MIT permission text.

None of these licences limits who may run the software or why. The GPLv2 text in wireguard-tools says: "The act of running the Program is not restricted." The GPL conditions apply when you distribute copies, for example if you ship a modified wg inside your own product. Running WireGuard at home or at work, on one server or a hundred, needs no permission and no payment.

One thing is not free to reuse: the name. The homepage states that "WireGuard" and the WireGuard logo are registered trademarks of Jason A. Donenfeld. The licences cover the code. They do not give you the right to call your own product "WireGuard".

Who pays for WireGuard development?

Free to you does not mean free to make. Someone pays the developers, and in WireGuard's case that someone is donors. The donations page asks for monthly gifts through GitHub Sponsors, PayPal, Patreon and Liberapay, and one-time gifts through Stripe, Bitcoin and PayPal. It explains why monthly giving matters: "Monthly donations help keep WireGuard development sustainable in the long run."

The same page lists corporate donors by tier. As of October 2026 it shows Jump Trading at the platinum tier, and it says Vultr also provides hardware and hosting for the project's infrastructure. The page also states that "The project is in no way influenced or directed by any external agendas." That list changes over time, so read the donations page itself for the current names. If your business depends on WireGuard, a donation is the honest way to pay for it, because there is no licence fee to pay instead.

Are WireGuard VPN keys free?

Yes, because you make them yourself. A WireGuard key is not issued by a company or bought from a store. The wg tool creates it on your own machine. The upstream quickstart shows this pattern, after setting a strict umask:

umask 077
wg genkey | tee private.key | wg pubkey > public.key

The wg(8) manual explains each half. wg genkey "Generates a random private key in base64 and prints it to standard output." wg pubkey "Calculates a public key" from that private key. tee writes the private key to private.key and also passes it on to wg pubkey, which writes the matching public key to public.key. The umask 077 line comes first so that the new files are readable only by your own user.

You keep private.key on the device and never send it anywhere. You give public.key to the other side of the tunnel. If you also want a preshared key for an extra layer, wg genpsk makes one the same way.

This matters for anyone searching for a "free WireGuard key" online. A key generated on someone else's server has been held by that server; a browser-based generator can create a key locally on your device without sending it to the website. A private key is only private if you are the only one who has ever seen it.

What does a free WireGuard config from a website really give you?

A WireGuard config file is short, and you can read every line of it. A typical client file has an [Interface] section with a PrivateKey, an Address and often a DNS line. Then comes a [Peer] section with the server's PublicKey, an Endpoint and an AllowedIPs line, which in a full-tunnel config reads 0.0.0.0/0 for IPv4 and ::/0 for IPv6.

Read those lines as facts about the far end. Endpoint identifies the peer's network address and port, which could be your own server. PrivateKey is your device's private key; the file does not tell you where it was generated or who holds a copy. 0.0.0.0/0 is a wildcard. AllowedIPs matches destinations for traffic routed into the WireGuard interface; it does not alone send all of your IPv4 traffic there. By default, wg-quick creates routes from AllowedIPs, but Table = off disables route creation, and its manual shows a 0.0.0.0/0 configuration that routes only SSH traffic through the tunnel. The DNS line, if present, specifies DNS servers or search domains for the interface.

The homepage also explains what the server does with each packet that arrives: after decryption and authentication, the packet's source address is checked against the peer's allowed IPs before it is accepted. In other words, WireGuard encrypts the hop between your device and that server. At the server the WireGuard encryption ends; a server configured as an internet gateway then forwards your traffic to the internet as its own.

From that mechanism you can reason about what the operator is able to see. This is not a list from a WireGuard document. It follows from how the tunnel works:

• Your real public IP address, because your encrypted packets arrive from it.
• The destination address and port of every connection routed through the server, because the server must read them to forward the traffic.
• The timing and size of your traffic through the tunnel.
• The full contents of anything you send through it without its own encryption, such as plain HTTP.

What the operator cannot read is the contents of connections that are encrypted end to end, such as HTTPS to a website. That encryption runs between your browser and the site, and the server in the middle only relays it. Which site you visited is still often clear from the destination address, and from the DNS lookup if the operator runs your resolver.

So a free config can set up a tunnel to your own server or to someone else's. Max Hogan's browser-based generator, for example, creates keys locally and tells you to copy the server block onto your own server. If a config connects to a stranger's server, that stranger controls the far end, and you cannot check from your side what they log or sell. That may be acceptable for a quick test. It is a poor choice for anything you would not show the operator.

What you actually pay for: the other end of the tunnel

The software costs nothing, so follow the money to the other end. That is the same approach as what Tailscale's free plan actually limits: the product is not the protocol, it is the service around it. The far end usually lives in one of three places.

A commercial VPN service

Some VPN companies offer WireGuard as one of their protocols. Proton VPN, for example, says on its protocol page that "WireGuard UDP" is available on Windows, macOS, Android, iOS and iPadOS, Android TV and Linux. You pay for their servers and their bandwidth. Some of these services have a free tier. Proton VPN's own free-plan page says the plan "Has no data or speed limits", covers "1 device" and "Does not log your online activity". Those are the provider's own claims, as of October 2026. Proton's support documentation also confirms that Free-plan users can download WireGuard configuration files. Check the protocol setting in the app.

The trust question from the free-config section applies here too. A VPN company also sits at the far end and sees what its server sees. The difference is that you know who the company is and can read its published policy, which is more than an anonymous download offers.

A mesh network built on WireGuard

Tailscale's own documentation says "Tailscale builds on top of WireGuard". Its job is different from a classic VPN service: it makes encrypted point-to-point connections between your own devices. Tailscale's pricing page lists a free Personal plan, described as "Free forever", for up to 6 users with unlimited user devices, as of October 2026. For how the two compare in daily use, see WireGuard vs Tailscale: plain tunnels or a managed mesh.

A VPS you run yourself

Here you rent a server and run wg0 on it. The software is still free. You pay the server's monthly price, and you spend your own time on updates and the firewall. In return you are the only operator at the far end, and nobody else holds your keys. The bill is whatever your provider charges for a small server, and how much a VPS costs breaks down what drives that price.

When is a free tier the better answer, and when is your own wg0?

Pick by who you want at the far end, and by how much work you will do yourself.

• Use a free VPN tier when you need a different exit location now and then, on one device, and you do not want to run a server. Accept that the provider sees what its server sees.
• Use Tailscale's free plan when the goal is reaching your own machines, such as a home server or a NAS (network-attached storage), from your laptop and phone, and your group fits inside its user limit.
• Run your own wg0 on a VPS when you want to be the only party at the far end, want an exit IP address that belongs to your own server, or already pay for a VPS that has spare capacity.
• Do not use a config with a private key generated on a stranger's server, or a tunnel to an unknown operator, for anything you care about. A browser-generated config for your own server is a different case: check where keys are generated and which endpoint it uses.

If you choose your own server, there are two good ways to build it. The manual route is setting up WireGuard by hand on a VPS, with keys, wg0.conf, IP forwarding and NAT (network address translation). If you would rather manage peers from a browser than edit files, running wg-easy for WireGuard in Docker covers the container route. To understand what AllowedIPs is really doing in any of these setups, read how WireGuard cryptokey routing works.

FAQ

Is WireGuard free for commercial use?

Yes. The kernel module and wireguard-tools are licensed GPLv2, the Windows and Apple clients use MIT licence text, and the Android client uses the Apache License 2.0. The GPLv2 text says "The act of running the Program is not restricted," so a business can run WireGuard on any number of servers without paying. The conditions apply only if you distribute copies, such as a modified build inside your own product. The name and logo are registered trademarks of Jason A. Donenfeld, so do not brand your own product as "WireGuard".

Where can I get a free WireGuard key?

You generate it yourself with the wg tool, so it is always free. Run umask 077 and then wg genkey | tee private.key | wg pubkey > public.key. That writes a random private key to private.key and the matching public key to public.key. Keep the private key on your device and share only the public key. Browser-based generators can also create keys locally without sending them to the website; avoid private keys generated on someone else's server.

Is a free WireGuard config from a website safe?

Check where its keys are generated and who runs its endpoint: a browser-based generator can create a config locally for your own server. AllowedIPs = 0.0.0.0/0 matches all IPv4 destinations for traffic routed into the WireGuard interface; the system's routing rules determine which traffic enters it. WireGuard's encryption ends at the peer. If that peer forwards your internet traffic, its operator can see your public IP address, the destinations you connect to through it, when and how much you send, and any unencrypted traffic. HTTPS contents stay encrypted between you and the website. You cannot check what an unknown operator logs, so do not use a tunnel to that operator for anything private.

Is Tailscale free if it is built on WireGuard?

Tailscale's documentation says it uses WireGuard at its core. As of October 2026 its pricing page lists a free Personal plan for up to 6 users with unlimited user devices. WireGuard itself stays free either way, because what Tailscale sells is its own service, not the protocol.

Do the WireGuard apps for Windows, Android and iPhone cost money?

The source code of each app is free: Windows and Apple under MIT licence text, Android under the Apache License 2.0. The official download links are on wireguard.com/install, including the Windows installer, the Play Store, an Android APK file and the App Store. That page does not state store prices, so check the listing in your app store, and install only from those official links.