Windows client 1.1.1
WireGuard encrypts the packet, then picks the peer by public key.
WireGuard is a layer 3 VPN tunnel for people who already have a peer to reach. This WireGuard VPN download is the Windows client, version 1.1.1, tagged on 20 September 2026. The amd64 MSI is 3.3 MB and the license is MIT. It runs on Windows 10, Windows 11, and Server 2016 through 2025.
Version 1.1.1. 20 September 2026. amd64 MSI 3.3 MB. MIT license. Windows 10, 11, and Server 2016 through 2025.
Updated .
Cryptokey routing
- 1. Packet dst 10.10.10.230 Plain IP, not encrypted yet.
- 2. Peer gN65BkIK... AllowedIPs match this public key.
- 3. UDP endpoint :51820 Send to the latest authenticated endpoint.
Published example from the project overview. Not a live key. When a packet arrives, the same table is an access check on the source address.
What is WireGuard?
WireGuard adds a tunnel interface, often named wg0 on other systems, and a Windows tunnel per config. You give it your private key and each peer's public key. It encapsulates IP packets in UDP. It does not ship a login, a subscription, or an exit server.
The Windows program is the WireGuardNT client. Jason A. Donenfeld is the author named by the project. After you import a .conf or a .zip, Activate brings the tunnel up. The window then shows a latest handshake and a transfer count for the peer.
What the client actually does
Five parts of the client, each linked to its own section.
-
Fixed cryptography
Noise_IKpsk2 with Curve25519, ChaCha20-Poly1305, BLAKE2s, SipHash24, and HKDF. One construction, not a menu of ciphers.
Open the primitive table -
Cryptokey routing
Each peer has a public key and an AllowedIPs list. Outbound packets pick a peer. Inbound packets must come from that list.
See the routing rules -
Roaming and keepalive
A peer's endpoint updates from the last authenticated packet. PersistentKeepalive stays at 0 unless NAT needs 25 seconds.
When to set 25 seconds -
Windows services
WireGuardManager draws the tray UI. Each tunnel is its own service, WireGuardTunnel$ plus the config name. Configs are stored with DPAPI.
Command list -
Block untunneled traffic
One peer with 0.0.0.0/0 or ::/0 turns the kill-switch on. Traffic stays off the normal connection if the tunnel drops.
Restore a stuck route
Who shows up with a config file
- Homelab
- Import one .conf and set AllowedIPs to the home LAN only. Web traffic keeps the normal route. Import steps
- Office full tunnel
- One peer with 0.0.0.0/0 turns on Block untunneled traffic, so a cafe drop does not spill the session. Kill-switch behavior
- Laptop that changes networks
- Roaming rewrites the endpoint from the last packet that authenticated. You do not restart the tunnel just because the Wi-Fi changed. Roaming notes
- Admin rollout
- Deploy the MSI, including with Group Policy. DO_NOT_LAUNCH skips the window after setup. Each config can be its own tunnel service. MSI files
WireGuard, OpenVPN, and IPsec
The project describes WireGuard against IPsec and OpenVPN. The whitepaper puts the Linux implementation under 4,000 lines, crypto primitives excluded. A Softonic comparison puts OpenVPN near 100,000 lines. No speed test is invented here.
| Criterion | WireGuard | OpenVPN | IPsec |
|---|---|---|---|
| Transport | UDP | TCP or UDP | ESP, usually negotiated with IKE |
| Identity | Short public keys, exchanged like SSH keys | Certificates or a static key, on TLS | Certificates and IKE policy |
| Cipher choice | Fixed Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s | A TLS menu | Negotiated suites |
| Size people cite | Under 4,000 Linux lines in the whitepaper, primitives excluded | Near 100,000 lines in the Softonic comparison | The project calls the usual stacks large and hard to audit |
| Roaming | Endpoint follows the last authenticated packet | Session state | IKE and policy state |
| Windows leak control | Block untunneled traffic when one peer has a /0 route | Depends on that client | Depends on that client |
| Account in the Windows app | None | Depends on the server | Depends on the server |
Check the file before you run it
The Windows installer picks the MSI for the CPU, checks the signature and the hash, then runs it. This page does not print a digest. A digest only helps when you compare it with the file in your downloads folder. Match the version and the size first: 1.1.1, amd64 or x86 at 3.3 MB, arm64 at 2.9 MB.
Some catalogs still show 0.5.3 from 23 December 2021, about 2.89 MB, with a 4.6 score on that old listing. That is not this client. Trust, license, and acceptable use
- MIT on Windows The Windows repository states an MIT license. No seat fee. No account.
- DPAPI at rest The manager encrypts an imported config to .conf.dpapi and limits it to Local System.
- Logs stay local The ring log is on the PC. It leaves only if you save it or run wireguard /dumplog into a file.
- Hash changes A scanner can quarantine wireguard.exe after an update because the file hash changed. What to check
Field reports
Published reports. Lengths vary. One of them is a complaint about an older build.
Handshake did not complete after 5 seconds, retrying. Restarting the tunnel cleared it almost every time. It showed up on about a dozen Windows PCs, sometimes weekly, while pings to the peer address still worked.
McAfee quarantined wireguard.exe right after an update. An exception lasted until the next build changed the hash, and the exception was dropped.
Ping across the tunnel worked. HTTP did not. G Data support called it a fundamental incompatibility and suggested turning the firewall off, connecting, then turning it back on.
The catalog calls that older build simple and quicker than the OpenVPN and IPsec setups it compared. It also calls the same build unstable, short on Windows driver support, and without a technical support desk.
Short answers
The Windows client is free and the repository licenses it under MIT. There is no seat to buy and no account to create. You still need a peer you are allowed to use. This download is the tunnel program, not a hosted VPN.
Yes. The project lists Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025. The current Windows client is 1.1.1, tagged on 20 September 2026.
A May 2021 report described McAfee quarantining wireguard.exe after an update, then dropping the exception when the hash changed. Match version 1.1.1 and the size on the download page before you restore a file.
No. The app imports a configuration and exchanges encrypted UDP with a peer you already have. It does not give you an exit node or an account.
If one peer has AllowedIPs of 0.0.0.0/0 or ::/0, Block untunneled traffic stays up so packets do not leak onto the normal connection. Deactivate the tunnel to lift that block.
Get client 1.1.1
amd64 and x86 MSIs are 3.3 MB. The arm64 MSI is 2.9 MB. The installer checks the signature and the hash before it runs the MSI.