No username. No password. No OTP. WireGuard decides who you are purely by keys — and once you understand that, every other WireGuard behaviour (sharing, revoking, QR codes) suddenly makes sense.
People hunt for the login page of a WireGuard server and find nothing, because there isn't one. Identity in WireGuard is a keypair, and the server trusts a fixed list of public keys. This page explains the model plainly, using the Untangle app from the video as the example — the firewall generates and stores the keys, but the rules below are true for every WireGuard setup anywhere.
Example configuration with fake placeholder keys. Your real config is generated by your own Untangle firewall — never copy keys from a web page.
Every other VPN you have used probably asked for a username and password. WireGuard asks for neither. Instead, every device generates a keypair: a private key that never leaves the device, and a public key that is safe to share. The server keeps a list of public keys it trusts — that list is the account database. When a client connects, it proves it holds the matching private key mathematically, without ever sending it. No password database also means no password database to leak, reset, or phish.
Think of the public key as a lock you can hand out freely — paste it into the server, email it, print it. The private key is the one physical key that opens it, and it exists in exactly one place: inside that device's config. This is why the client config file and the QR code matter so much. The QR code contains the private key. Scanning it is not "viewing" the config — it is copying the key itself into the phone. Anyone who photographs that QR code owns a working copy of that tunnel.
On a hand-built Linux server you run wg genkey yourself. On the Untangle app, the firewall generates the server's keypair when the app starts, and each tunnel you add gets its own keypair, which travels to the client inside the config file or QR code from the Remote Client view. You never type a key by hand — which is good, because a single wrong character in a 44-character key is the most silent failure in all of WireGuard: no error, just no handshake.
There is no "change password" button because there is no password. The correct move when a phone is lost or a config was shared too widely is: delete that tunnel on the firewall (every copy of the config dies instantly) and create a fresh tunnel with fresh keys for the replacement device. Editing keys in place invites confusion; delete-and-recreate is clean, takes a minute, and leaves no half-trusted state behind. The revocation guide in this series covers the full routine, including the day a staff member leaves.
See the tunnels being created and the client configs handed out live in the full setup video.
▶️ Watch Full VideoThey should not. Both devices would present the same identity and the same tunnel address, and WireGuard will keep switching the connection between them — the classic 'it connects, then drops' complaint. Always create one tunnel per device.
They get a complete working copy of that tunnel, private key included, and can connect as that device until you delete the tunnel on the firewall. Treat QR codes and config files like passwords.
WireGuard supports an optional preshared key as an extra layer on top of the keypair. The Untangle app focuses on the standard keypair flow shown in the video; the keypair alone is already strong encryption — the discipline that matters is keeping the private key private.