WordPress Salts Generator
Eight fresh security keys and salts for wp-config.php, generated in your browser from the system's cryptographic random source. Copy the block, paste it over the old one, done.
Your new keys and salts
64 characters each from the set WordPress uses, generated with crypto.getRandomValues. Nothing is stored or sent; reload for another set.
How to use it
- Press Generate new salts (a set is ready as soon as the page loads).
- Copy the eight define() lines.
- Replace the existing AUTH_KEY to NONCE_SALT block in wp-config.php and save. Everyone is logged out once; that is expected.
Why unique salts matter on every install
WordPress signs its login cookies with a hash that mixes the user's password hash, an expiry time and these keys. If two sites share the same keys, which happens whenever a site is cloned from a template or a hosting image, a cookie minted on one validates on the other. If the keys are the installer placeholders, anyone who knows the username and password hash from a leaked database can forge a session without cracking the password.
Rotating the keys costs nothing but one forced re-login, so it belongs in every cleanup after a compromise and in the checklist for any site that was copied from another.
WordPress salts FAQ
What do the WordPress salts do?
They are secret strings mixed into the hashes WordPress stores in login cookies and nonces. With them, a cookie copied from one site cannot be replayed on another, and a stolen database alone is not enough to forge a session. WordPress works without them, but every install should have unique ones.
When should I change the salts?
When you suspect a compromise (a stolen wp-config.php or database backup, a malware cleanup), after moving a site that was cloned from another one, and when the keys in wp-config.php are still the placeholder "put your unique phrase here". Changing them is also a quick way to force every user to log in again.
What happens to logged-in users when I change them?
Every existing login cookie stops validating, so every user, including you, is logged out and has to sign in again. Nothing else is affected: passwords, content and settings stay as they are.
Is this safer than the WordPress.org secret-key service?
Both produce random keys. The difference is where: the WordPress.org service generates them on its server and sends them to you over HTTPS; this page generates them inside your browser with crypto.getRandomValues, and they never leave your device. The characters used are the same set WordPress itself accepts.
How do I install them?
Open wp-config.php in the site root, find the block of eight define() lines that starts with AUTH_KEY, and replace the whole block with the generated one. Keep the file encoding as UTF-8 without BOM and do not leave a duplicate define, which PHP reports as a notice.
More free tools: Password Generator · Security Headers Checker · WordPress Theme Detector · .htaccess Redirect Generator