Keys are made in this tab. crypto.subtle or crypto.getRandomValues produces
every one, and nothing is transmitted. Generate again and the whole set is replaced, invalidating configs you
already copied. You are trusting the page you loaded: treat a private key pasted into any website, this one
included, as burned. For a real server, run wg genkey | tee privatekey | wg pubkey > publickey
on the machine itself and paste only the public halves.
On a client, AllowedIPs is both the route (which destinations enter the tunnel) and the cryptographic filter (which source addresses the server may send back from). Everything (0.0.0.0/0, ::/0) tunnels all traffic. VPN subnet only reaches peers and the server, leaving browsing local. Custom list takes the prefixes you name.
WireGuard has no exclude syntax, so keeping one address out means listing every other prefix, a long list of CIDR blocks. The AllowedIPs calculator does that subtraction and prints it paste-ready.
A preshared key is 32 random bytes mixed into every handshake on top of X25519. Being symmetric, it defeats an attacker who records traffic today and breaks X25519 later on a quantum computer. The cost is one more secret on every peer.
Keepalive is for peers behind NAT. Many NAT boxes drop a UDP mapping after 30 seconds of silence, leaving the server unable to reach an idle peer. An empty packet every 25 seconds holds the mapping open. A server on a public address with no NAT can leave it at 0.