VPN Config Auditor
The VPN Config Auditor grades a WireGuard .conf, OpenVPN .ovpn, ipsec.conf or swanctl.conf file from 0 to 100 in your browser, explains every weak setting with the line it came from and its fix, and writes a hardened copy you can download.
Your config never leaves this page. No request is made with it. It audits as you type; Ctrl + Enter runs it at once.
Nothing is uploaded.
How the audit works
The page detects the format from the text: a [Interface] or [Peer] header means WireGuard, a connections { } block means swanctl.conf, a conn or config setup block means ipsec.conf, and OpenVPN directives such as client, remote or dev tun at the start of lines mean an .ovpn profile. You can also set the format yourself. A parser then reads every directive with its line number and keeps a list of lines it could not place.
Format-specific checks run against that parse. For OpenVPN they cover broken ciphers such as BF-CBC, weak control-channel HMACs, compression (VORACLE), a control channel without tls-auth or tls-crypt, missing server certificate checks, TLS 1.0 or 1.1, cached credentials and logging. For WireGuard they cover full tunnels with no DNS setting or kill switch, IPv6 left outside the tunnel, DNS servers outside a split tunnel, duplicate peers and MTU. For IPsec they cover IKEv1 and aggressive mode, weak proposals, weak pre-shared keys and perfect forward secrecy turned off.
Every finding names its line, or says the setting is missing. The page also lists key material found in the text and builds a hardened copy that applies the fixes needing nothing outside the file. Evidence is the file alone: the server side, your firewall, the OS resolver and files the config only names stay out of view.
How to read the result
Critical and high
Critical costs 30 points and high costs 15. One of these, such as a Sweet32 cipher or an aggressive-mode PSK, is usually enough to undo the tunnel.
Medium and low
Medium costs 7 points and low costs 3. These weaken the setup or leak detail without breaking the encryption outright.
Info
Context with no cost, such as tls-crypt being in use or the file holding a private key.
Score and grade
100 minus the costs, floor 0. A is 90 or more, B 75 or more, C 60 or more, D 40 or more, F below 40. The formula for your file is printed next to the score. The weighting is ours.
Tap a severity tile to show only those findings, open a finding for why it matters and the fix, and use the line link to select that line in the box. The examples are fabricated, with placeholder keys and documentation-range addresses.
Questions
Is my config uploaded anywhere?
No. Parsing, grading and the hardened copy all run in JavaScript already on this page, and a dropped file is read with the browser's FileReader. No request is made with the config. You can confirm it in the Network tab of your browser's developer tools.
Which config formats can it read?
WireGuard .conf files, OpenVPN .ovpn profiles, ipsec.conf for strongSwan or Libreswan, and strongSwan swanctl.conf. The format is detected from the file, or you can pick it from the Format list.
How is the score calculated?
The score starts at 100 and loses 30 points per critical finding, 15 per high, 7 per medium and 3 per low, with a floor of 0. Info findings cost nothing. Grade A is 90 or more, B 75 or more, C 60 or more, D 40 or more, and F below 40.
What does the hardened copy change?
Only fixes that need nothing outside the file, such as removing compression or replacing a broken cipher. Values only you know, such as a tls-crypt key or the server's certificate name, are added as TODO lines. Match the server side before you deploy it.
What can the auditor not see?
The server side, your firewall, the operating system resolver, the client app's own kill switch, and files the config only names, such as ca.crt or ipsec.secrets. Lines it does not recognise are listed in the Parsed view so nothing is skipped silently.
Sources: OpenVPN 2.6 manual, wg-quick(8), strongSwan, Libreswan ipsec.conf(5), Sweet32 (CVE-2016-2183), VORACLE (2018), Logjam (2015), RFC 8996, RFC 9395.