WordPress salt key generator for wp-config.php
Fresh, cryptographically secure secret keys and salts generated directly inside your browser. No data ever touches a remote server.
/**#@+ * Authentication unique keys and salts. * * Change these to different unique phrases to invalidate all existing cookies. * This will force all users to have to log in again. * * @since 2.6.0 */ define( 'AUTH_KEY', 'put your unique phrase here' ); define( 'SECURE_AUTH_KEY', 'put your unique phrase here' ); define( 'LOGGED_IN_KEY', 'put your unique phrase here' ); define( 'NONCE_KEY', 'put your unique phrase here' ); define( 'AUTH_SALT', 'put your unique phrase here' ); define( 'SECURE_AUTH_SALT', 'put your unique phrase here' ); define( 'LOGGED_IN_SALT', 'put your unique phrase here' ); define( 'NONCE_SALT', 'put your unique phrase here' ); /**#@-*/
What the eight WordPress keys actually do
Session Cookies
AUTH_KEY and SECURE_AUTH_KEY encrypt user sessions so session tokens cannot be forged or hijacked.
Nonces & Forms
NONCE_KEY and NONCE_SALT generate one-time tokens that protect admin forms from CSRF and replay attacks.
Salting Entropy
The four _SALT constants append unique random entropy to passwords and cookies before hashing.
Instant Logout
Changing any salt key instantly logs out every logged-in user and admin across all browsers and devices.
How to update your WordPress salts in 3 steps
Copy the generated keys
Select your format (wp-config.php or .env) and click Copy Keys above to grab the fresh random strings.
Replace the existing block
Open wp-config.php via SFTP, SSH, or your host file manager, locate the 8 define() lines, and paste.
Save and sign back in
Save the file. All active sessions are terminated immediately. Sign back into /wp-admin with your password.
More free WordPress security tools
Frequently asked questions
What are WordPress salts and keys?+
Salts and keys are cryptographic random strings in wp-config.php that WordPress uses to sign and encrypt login sessions and auth cookies. Unique, high-entropy values prevent cookie forgery and session hijacking.
How often should I change WordPress salts?+
You should rotate salts whenever a site has been compromised, after an administrator or contractor leaves, or periodically every 3–6 months as part of routine WordPress security hardening.
Is it safe to generate salts online?+
Yes, this generator runs 100% in your browser using the native Web Crypto API (crypto.getRandomValues). Zero network requests are made, and no keys ever touch our servers. You can even disconnect from Wi-Fi and click Regenerate.
Will changing salts log out my active users?+
Yes. Changing any salt invalidates all existing cookie hashes, instantly logging out every logged-in user, administrator, and customer on the site. You will need to sign in again immediately.