Free · Private · Client-side

WordPress Salt Generator

Generate all eight WordPress security keys and salts and copy them into wp-config.php. AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and the matching salts are created in your browser.

Generated values never leave this device.

All 8 keys generate together — paste the wp-config block below into your wp-config.php. Press R to regenerate.

Each salt is 64 characters drawn from a 92-character pool ≈ 417 bits of entropy — far beyond brute force. WordPress uses these to sign cookies and nonces, so they never need to be memorized.

wp-config.php salts

This block is the value WordPress reads. Copy it over the authentication keys in wp-config.php.

wp-config.php

1define('AUTH_KEY', '');
2define('SECURE_AUTH_KEY', '');
3define('LOGGED_IN_KEY', '');
4define('NONCE_KEY', '');
5define('AUTH_SALT', '');
6define('SECURE_AUTH_SALT', '');
7define('LOGGED_IN_SALT', '');
8define('NONCE_SALT', '');

Individual keys

AUTH_KEY

SECURE_AUTH_KEY

LOGGED_IN_KEY

NONCE_KEY

AUTH_SALT

SECURE_AUTH_SALT

LOGGED_IN_SALT

NONCE_SALT

What these keys do

AUTH_KEY/SALT: Encrypts admin cookies
SECURE_AUTH_KEY/SALT: Encrypts SSL admin cookies
LOGGED_IN_KEY/SALT: Encrypts non-SSL logged-in cookies
NONCE_KEY/SALT: Protects nonces against CSRF attacks

When to regenerate

Regenerate these keys if you suspect your site has been compromised. This will invalidate all existing logged-in sessions, forcing all users (including yourself) to log in again.

Official WordPress Salt Generator

WordPress also provides an official API for generating salts:

Fetch from WordPress.org API

$curl https://api.wordpress.org/secret-key/1.1/salt/

Installation

Copy the generated keys and paste them into your wp-config.php file, replacing any existing salt definitions:

wp-config.php

<?php
/**
 * Authentication Unique Keys and Salts.
 *
 * Change these to different unique phrases!
 * https://api.wordpress.org/secret-key/1.1/salt/
 */
define('AUTH_KEY', '');
define('SECURE_AUTH_KEY', '');
define('LOGGED_IN_KEY', '');
define('NONCE_KEY', '');
define('AUTH_SALT', '');
define('SECURE_AUTH_SALT', '');
define('LOGGED_IN_SALT', '');
define('NONCE_SALT', '');

/* That's all, stop editing! */

These are WordPress cookie salts, not a password-hashing salt. For a general salt, use the salt generator. Framework keys: Django, Laravel, Flask.