WordPress Salts Generator

define( 'AUTH_KEY', '' ); define( 'SECURE_AUTH_KEY', '' ); define( 'LOGGED_IN_KEY', '' ); define( 'NONCE_KEY', '' ); define( 'AUTH_SALT', '' ); define( 'SECURE_AUTH_SALT', '' ); define( 'LOGGED_IN_SALT', '' ); define( 'NONCE_SALT', '' );

What are WordPress salts and keys for?

WordPress signs authentication cookies and nonces using a set of secret keys and salts defined in wp-config.php. There are eight in total — four keys (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY) and their matching _SALT pairs. Each should be a long, random, unpredictable string — never the placeholder text from the default template.

How to add them to your project

Copy the generated block above and paste it into wp-config.php, replacing the existing define('AUTH_KEY', ...) lines (or the placeholder block if this is a fresh install).
Save the file and reload the site — all active sessions will be logged out.
Never commit wp-config.php with real salts to a public repository; keep it out of version control or load the values from environment variables instead.

Rotating keys after a compromise

If you suspect a session or cookie was stolen, regenerating all eight values immediately invalidates every existing login across the site — a fast way to force re-authentication everywhere without touching the database.

Frequently asked questions

What are WordPress authentication keys and salts?

AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY (plus their _SALT counterparts) are random strings WordPress mixes into the cookies and hashes it uses to identify logged-in users and validate nonces. They're defined once in wp-config.php.

What happens if I change them?

All logged-in users are immediately logged out, since existing auth cookies no longer validate against the new keys. This is expected and often used deliberately to force a full logout after a suspected compromise.

Why does WordPress avoid single quotes and backslashes in salts?

wp-config.php defines these constants inside single-quoted PHP strings: define('AUTH_KEY', '...'). A literal single quote or backslash in the value would break the string and cause a fatal error. This generator's charset excludes both characters for that reason — same approach as the official WordPress.org secret-key API.

Do I need to use WordPress.org's official secret-key API?

No — the official API (api.wordpress.org/secret-key/1.1/salt/) is just a convenience endpoint that returns the same kind of random values. Generating them locally in your browser works identically and avoids depending on an external request during setup.

What it does

Privacy

When to use this tool

Common mistakes