WordPress Salts Generator

What this tool is used for

• Filling in the keys and salts on a fresh install rather than leaving the placeholder text in place.
• Rotating the values after a suspected compromise, which invalidates every existing session at once.
• Forcing all users to sign in again without touching a single stored password.
• Producing distinct values per environment so a staging cookie is useless against production.
• Replacing values that were copied from a tutorial and are therefore public.

Frequently Asked Questions

What do WordPress salts actually do?

They are eight secret keys in wp-config.php used to hash authentication cookies and nonces. Without unique values, a session cookie forged against one site would be valid on any other with the same keys.

What happens when I change them?

Every logged-in user is immediately signed out, including you, because existing cookies no longer validate. That is the intended effect and is exactly why rotating salts is the standard first step after a suspected compromise.

Which keys are required?

Eight: AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and their four matching _SALT counterparts. Missing ones fall back to defaults, which silently weakens the hashing rather than erroring.

How often should they be rotated?

Not on a schedule — there is no benefit to routine rotation. Rotate after a suspected breach, when a developer with config access leaves, or when moving a site between environments.

Is generating these in a browser safe?

Here yes, because they are produced locally with crypto.getRandomValues and never transmitted. Fetching salts from a remote generator means a third party has seen the keys protecting every session on your site.

Where do the salts belong?

In `wp-config.php`, which sits above the web root on a well-configured install and is never served. If that file is ever readable over HTTP, the salts are the smaller problem — the database credentials are in the same file.

What is the difference between the KEY and SALT constants?

The keys are the secrets used to sign cookies; the salts are mixed in when hashing them. WordPress will generate a missing salt on the fly, but a hardcoded one is stable across restarts, which is why all eight belong in the config.

Do the salts protect stored passwords?

No — user passwords have their own per-user hashing. These constants secure authentication cookies and nonces, so changing them logs everyone out without touching a single stored password.

Common errors and gotchas

• Leaving the default placeholder strings in place, which is equivalent to having no salts at all.
• Copying one site's values to another, so a cookie forged for one works against the other.
• Rotating them without warning anyone, then fielding reports that everybody was logged out.
• Expecting them to protect stored passwords. They cover cookies and nonces, not the password hashes.
• Putting them somewhere other than the configuration file, where WordPress will not read them and will fall back silently.