WordPress Salt & Security Key Generator
Generate the eight security keys and salts for wp-config.php.
| Constants | 8 |
|---|---|
| Length each | 64 characters |
| Entropy each | approx. 419 bits |
| Source | random_int() — OS cryptographic randomness |
define( 'AUTH_KEY', 'eVyqtJY7OZc$+8y)/D;9=;QH:d3R{K5LU"\'/4YE]]qma3M\'L=)r4!xv/h;57hQ2e' );
define( 'SECURE_AUTH_KEY', '(|M\'8N<)jz`00}\\qIn{!r0%_R&Cm5\\j^=zHQu<5;F\'O\\8ds|41"{F~0\\9I)8nSP.' );
define( 'LOGGED_IN_KEY', 'ubB9T.QqfO4;}$5my,0rd~=~+1GY;32ej~ZJgQs$x!E#e<2FfppL/XX(kK{m|N.g' );
define( 'NONCE_KEY', '"d(sSZvS{&4sW5f#5m-6#Aop,c~E6{1T)\']|n_#Fb9Dk/*4{BJGY"eF`McQ_!u1^' );
define( 'AUTH_SALT', '21*%KRzT+PaFfc?>p!}Y`+N~Q\'([2mC={Vca=f3QhwGb)L:$Yn:$0\\w4lgT|5bv<' );
define( 'SECURE_AUTH_SALT', 'NCF,%*m_61*NSNCRB{<:,QBzH!%VM"}tV6H8LwYCWzoau+Lg4rtf:\'20<-j3JALr' );
define( 'LOGGED_IN_SALT', '-p?}+c[[f8v}DzpE\'5|JVFit9YO8u1}y.{oqp.*Df:rnD=E_[7ryy`^bO1$!?y9]' );
define( 'NONCE_SALT', '|VaM4VfK3zgSC7QrzuZfUv!:*@+iwzUA{yz%h(D%,,{.z.237\'TATESx[rE{y:q{' );
Generates the eight define() lines WordPress expects in
wp-config.php — four keys and four salts, each 64 characters of
cryptographically secure randomness. Copy the block and replace the matching
lines in your config file.
Unlike most salt generators, this one does not fetch your keys from the WordPress.org API. They are produced on this server and sent only to you.
How it works
WordPress stores login state in cookies. Those cookies must be tamper-proof, or anyone could edit one and claim to be an administrator. The defence is a keyed hash: WordPress signs each cookie with a secret that only your installation knows, and rejects any cookie whose signature does not match.
The eight constants split that job in two. The four keys
(AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY,
NONCE_KEY) are the secrets used to sign. The four
salts are mixed into the hashed value, so two sites that
somehow shared a key would still produce different signatures. Each pair covers
a different context: plain authentication, authentication over HTTPS, the
"logged in" state, and the nonces that protect form submissions against
cross-site request forgery.
Changing these values invalidates every existing cookie at once. Everyone currently signed in — including you — is logged out, and any in-flight nonce stops validating. Nothing else breaks: they are not encryption keys, so no stored content becomes unreadable. That makes rotating them a cheap, safe first move whenever a site may have been compromised.
The characters here are drawn from the full printable ASCII range, which is what WordPress itself uses. That includes quotes and backslashes, so the output below is already escaped for single-quoted PHP strings — paste it as given rather than retyping it.
Frequently asked questions
Where do these go in wp-config.php?
Look for the block headed "Authentication Unique Keys and Salts", usually about halfway down the file. Delete the eight existing define() lines and paste these in their place. Do not add them twice — PHP will warn about redefining a constant.
What happens when I change them?
Every logged-in user is signed out immediately, including you, and any form currently open will fail its nonce check on submit. Nothing is lost: posts, users, passwords and settings are untouched, because these are signing secrets rather than encryption keys.
How often should I rotate them?
There is no routine schedule worth keeping. Rotate them immediately after a suspected compromise, after removing a plugin you did not trust, or when a contractor with file access leaves. Rotating them for its own sake only logs your users out.
Is this safer than the WordPress.org salt API?
Marginally, and for one reason: keys from the API travel across the internet and are generated by a machine you do not control. These are generated here from the operating system random source and are not written to any log. Either is acceptable; neither should be reused across sites.
Can I use the same keys on staging and production?
You can, and many teams do so accidentally by copying wp-config.php between environments. Prefer separate values. Sharing them means a cookie minted on staging is valid on production, which turns a low-security environment into a way into a high-security one.
My site broke after pasting these — what went wrong?
Almost always a quoting problem. The values contain characters that are meaningful in PHP strings, so a stray unescaped quote ends the string early. Copy the whole block with the button below rather than retyping it, and check you have not left the old define() lines in place as well.
Related tools
Password Generator
Generate strong random passwords or memorable passphrases.
SecurityBcrypt Generator & Verifier
Hash a password with bcrypt or Argon2, or check one against a hash.
Security.htpasswd Generator
Create Apache basic-auth credentials in bcrypt, APR1 or SHA-1.
SecurityHash Generator
Generate MD5, SHA-1, SHA-256, SHA-512, SHA-3 and CRC32 hashes at once.
Developer UtilitiesSecurity Headers Checker
Grade any site's HTTP security headers and see exactly what to add.
SecurityUUID Generator
Generate UUID v4, time-ordered UUID v7, or ULIDs in bulk.
Developer UtilitiesNeed hosting that just works?
Free SSL, daily backups and 24×7 support on every Loudhost plan.