WordPress Salts Generator

What are WordPress salts?

Salts are the eight AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, AUTH_SALT, SECURE_AUTH_SALT, LOGGED_IN_SALT, and NONCE_SALT constants in wp-config.php. WordPress uses them to hash and sign the cookies that keep you logged in, and the nonces that protect form submissions.

If those values are weak, guessable, or shared across sites, an attacker who already has a foothold has a much easier time forging sessions.

When should I rotate them?

• On a fresh install, always. The install script sometimes fills them in for you and sometimes leaves them as put your unique phrase here. Don't ship with defaults.
• After any suspected compromise. Rotating salts invalidates every logged-in session, forcing everyone to sign in again with the credentials you've hopefully also just rotated.
• Every so often, on a maintenance cadence. Once a year is fine for most sites.

How this tool works

Nothing leaves your browser. Salts are generated using crypto.getRandomValues, the same cryptographic primitive your browser uses for TLS. Click regenerate as many times as you like. Copy the block, paste it into your wp-config.php between the existing define(...) lines, then upload.

Rotating salts logs out every user, including you. Do it during a quiet moment.