Free · Private · Client-side
WordPress Security Keys & Salts
Generate all 8 secure authentication keys and salts for your WordPress wp-config.php file. These enhance the security of cookies and user sessions.
Generated values never leave this device.All 8 keys generate together — paste the wp-config block below into your wp-config.php. Press R to regenerate.
Each salt is 64 characters drawn from a 92-character pool ≈ 417 bits of entropy — far beyond brute force. WordPress uses these to sign cookies and nonces, so they never need to be memorized.
Generated keys & salts
Copy into wp-config.php
1define('AUTH_KEY', '');2define('SECURE_AUTH_KEY', '');3define('LOGGED_IN_KEY', '');4define('NONCE_KEY', '');5define('AUTH_SALT', '');6define('SECURE_AUTH_SALT', '');7define('LOGGED_IN_SALT', '');8define('NONCE_SALT', '');What these keys do
- AUTH_KEY/SALT: Encrypts admin cookies
- SECURE_AUTH_KEY/SALT: Encrypts SSL admin cookies
- LOGGED_IN_KEY/SALT: Encrypts non-SSL logged-in cookies
- NONCE_KEY/SALT: Protects nonces against CSRF attacks
When to regenerate
Regenerate these keys if you suspect your site has been compromised. This will invalidate all existing logged-in sessions, forcing all users (including yourself) to log in again.
Official WordPress Salt Generator
WordPress also provides an official API for generating salts:
Fetch from WordPress.org API
curl https://api.wordpress.org/secret-key/1.1/salt/Installation
Copy the generated keys and paste them into your wp-config.php file, replacing any existing salt definitions:
<?php
/**
* Authentication Unique Keys and Salts.
*
* Change these to different unique phrases!
* https://api.wordpress.org/secret-key/1.1/salt/
*/
define('AUTH_KEY', '');
define('SECURE_AUTH_KEY', '');
define('LOGGED_IN_KEY', '');
define('NONCE_KEY', '');
define('AUTH_SALT', '');
define('SECURE_AUTH_SALT', '');
define('LOGGED_IN_SALT', '');
define('NONCE_SALT', '');
/* That's all, stop editing! */