Your keys and configuration files

Every WireGuard tunnel is secured by a key pair. Who holds the private key depends on how the tunnel was created.

Tunnels created on the website

We generate the key pair for you so you can import a ready-made configuration. The private key is in the configuration — the Download .conf file, the text you Copy, and the QR code.

• Keep them private. Anyone with the file or a photo of the QR code can use your tunnel — and your plan's data and device allowance.
• Once it's imported into WireGuard, you can delete the downloaded file.
• We don't keep the private key. The configuration is shown once, right after you create the tunnel, and then it's gone from our side — we can't show it again or hand it to anyone. To set up another device later, open the tunnel and select Get a new configuration: the tunnel gets a new key pair and the old configuration stops working.

If you think someone has your configuration, open the tunnel from Tunnels and select Get a new configuration (or Disconnect it). The old configuration stops working immediately.

Tunnels created by Ghostunnel apps

The apps generate the key pair on your device and send us only the public key. The private key never leaves your device, so these tunnels have no downloadable configuration — their page says so.

Your account

Your password protects all of this. Use a unique one, and change it if you think it's been exposed — that also signs out your Ghostunnel apps.