Latchwire

Open source · WireGuard® compatible

Your VPN key can't be copied.

Latchwire keeps your WireGuard private key inside a hardware security key such as a YubiKey. The key is generated on the device and never touches your disk or memory. No key plugged in, no tunnel.

Early preview — command-line core for macOS and Linux

View on GitHub How it works

How it works

  1. Plug in your key

    Latchwire generates the WireGuard key inside it, in a dedicated PIV slot. Your login slots are left untouched.

  2. Add the public key to your server

    Any standard WireGuard server works — OPNsense, pfSense, Linux, MikroTik and others. No plugins, no server changes.

  3. Enter your PIN and connect

    The PIN is asked once while the key is plugged in. Pull the key out and the tunnel closes within about two seconds.

Classic WireGuard vs Latchwire

QuestionClassic WireGuardLatchwire
Where is the private key?A file on your computerInside the hardware key
Can it be copied?Yes, silentlyNo
Laptop stolen?Rotate the key everywhereNo access without the key
Server sideStandard WireGuardThe same — standard WireGuard

Hardware

Latchwire talks to the key through standard interfaces. Support is added one device family at a time.

YubiKey 5

Supported now

PIV, firmware 5.7 or later

OpenPGP cards

Planned

YubiKey, Nitrokey 3

PKCS#11 / HSM

Planned

Devices with X25519 support

TPM · Secure Enclave

Roadmap

Listed separately: here the key is only encrypted at rest, not uncopyable.

Security

What Latchwire does and does not protect against, stated plainly.

Protects against

  • Copying the key from your disk or backups
  • A stolen laptop when the key is not with it
  • Config files that carry a private key — Latchwire rejects them

Does not protect against

  • Malware on your computer: while the key is plugged in, it can use the tunnel.

Good to know

  • The PIN is never stored.
  • The default PIN is never tried.
  • Every claim on this page is documented.
Read the threat model Report a vulnerability

Install

Build from source

git clone https://github.com/Kodviva/latchwire
cd latchwire
go build -o latchwire ./cmd/latchwire

Requirements: Go 1.25+, a YubiKey 5 with firmware 5.7+; on Linux also pcscd and libpcsclite.

Desktop apps for macOS, Windows and Linux are in development.

Hardware test checklist

Roadmap

  1. CoreDone

    Command-line client for macOS and Linux

  2. Full network features

    DNS, full tunnel, kill switch

  3. Desktop app and translations

    Desktop app for macOS, Windows and Linux

  4. Signed releases

    Homebrew, Microsoft Store, Linux packages