WordPress salt generator
Eight fresh authentication keys and salts for wp-config.php, generated here in your browser with crypto.getRandomValues — no request to api.wordpress.org, and nothing sent to WPSalt.
Copy all eight lines and paste them over the matching block in wp-config.php. Everyone signed in is logged out the moment you save — including you.
What these eight values actually do
WordPress signs things with them. When you log in, WordPress writes an authentication cookie and signs it using these secrets; on every later request it checks that signature to decide whether the cookie is genuine. The same secrets add entropy to nonces — the one-time tokens protecting forms and AJAX requests from being replayed by another site.
What they are not is password storage. Passwords live in the users table as one-way hashes and have nothing to do with these constants, which is why rotating salts logs people out without changing a single password. The practical consequence runs the other way, though: a leaked AUTH_KEY and AUTH_SALT pair lets someone forge a valid-looking session cookie without ever knowing a password. They belong in the same category as your database credentials, not in a support ticket or a screenshot.
For the key-by-key breakdown of which cookie each pair signs, see the full salts generator page; for when a rotation is actually worth doing, the keys and salts guide covers the decision.
Where these lines go in wp-config.php
Open wp-config.php in the WordPress root — the same directory as wp-admin and wp-content — and look for a block of eight define() lines above the “That's all, stop editing!” comment. On a fresh install they all read put your unique phrase here, which is the one state you should never leave in place.
/**#@+ * Authentication unique keys and salts. * Change these to different unique phrases! */ define( 'AUTH_KEY', 'put your unique phrase here' ); define( 'SECURE_AUTH_KEY', 'put your unique phrase here' ); define( 'LOGGED_IN_KEY', 'put your unique phrase here' ); define( 'NONCE_KEY', 'put your unique phrase here' ); define( 'AUTH_SALT', 'put your unique phrase here' ); define( 'SECURE_AUTH_SALT', 'put your unique phrase here' ); define( 'LOGGED_IN_SALT', 'put your unique phrase here' ); define( 'NONCE_SALT', 'put your unique phrase here' ); /**#@-*/ $table_prefix = 'wp_'; /* That's all, stop editing! Happy publishing. */
Replace all eight lines with the generated block, keeping everything around them. Alignment and the spacing inside define( … ) are cosmetic — PHP does not care, so paste the whole block rather than editing values one at a time. Two mistakes account for most of the broken configs that follow: leaving a duplicate define() for a constant further down the file (the first one wins, silently), and pasting below the “stop editing” line, where WordPress has already loaded and the constants arrive too late to be used.
Save, reload the site, and sign in again. If the site returns a blank page instead, the paste broke the PHP — restore your backup of wp-config.php and try again rather than editing around the error.
Quick answers
Is it safe to generate WordPress salts on a website?
On this one, the values never leave your browser: the page has no server-side generator, it calls crypto.getRandomValues locally, and it makes no network request with the result. That is worth checking rather than trusting — the source is public, and your browser's network tab will show nothing leaving the page. Treat any generator that produces salts server-side with more caution, since it has seen values you are about to make your site's secrets.
Do I have to replace all eight values at once?
Replace all eight together. Rotating only some of them leaves the untouched constants still signing with the old secret, which gains you nothing over a full rotation and makes the site's state harder to reason about later. Generating a complete block and pasting it over the old one is both safer and less work.
Are these the same as the ones from api.wordpress.org?
They are different random values serving exactly the same purpose, in the same format. WordPress does not register your salts anywhere, so there is no canonical set for your site — any eight sufficiently random strings work. The only difference is where the randomness comes from: the WordPress.org API generates them on its server, this page generates them on your machine.
How long should a WordPress salt be, and which characters are allowed?
The convention is 64 characters, which is what WordPress.org's own API returns and what this generator produces. Almost any printable character is valid, but two are worth avoiding inside the single-quoted PHP strings WordPress uses: an apostrophe and a backslash, both of which can end or escape the string and break the file. This generator omits them from its character set for that reason.
Password hash and security-key tools for WordPress
Everything here runs locally in the same way. The number on each card is its keyboard shortcut — salts, above, is 1.
$wp$2y$ value WordPress 6.8+ stores.
03 · Hash
Legacy password hash
phpass $P$ for WordPress 6.7 and earlier.
04 · Server
htaccess rules
Standard WordPress rewrite block plus Apache hardening.
05 · Check
Hash verifier
Identify a hash format, or test a password against one.
Built for sensitive values
WPSalt is a static, open-source tool. Passwords and generated secrets are processed in your browser and are never sent to WPSalt. See the methodology and privacy details before using it with production systems, and the guides when the hash or the lockout in front of you needs explaining.