WordPress salt generator
Get 8 fresh secret keys for wp-config.php. They are made in your browser, shown once, and never sent anywhere.
Made on your device with your browser's secure random generator. Never sent anywhere, never stored. Reload the page and you get new ones.
Making your keys…
Replace the 8 lines in wp-config.php that start with define( 'AUTH_KEY'. Do not add a second set.
Each value is 64 characters picked from a set of 92: about 418 bits. Prefer the official service? Open api.wordpress.org/secret-key/1.1/salt/. It is only a link; this page never calls it.
How it works
What the 8 keys do
WordPress uses them to sign the login cookie and the one-time codes (nonces) that protect forms. Long random values are hard to forge.
What this tool does, and does not do
- It does not change your site. You paste the lines in yourself.
- It does not make a site safe by itself.
How to use the result
- Back up first. Download
wp-config.phpand keep a copy to put back if a typo breaks the site. - Open
wp-config.phpin your host's file manager or over SFTP. Find the 8 lines fromdefine( 'AUTH_KEY'throughNONCE_SALT. - Delete those 8 lines and paste the lines from the tool. Do not leave the old ones or add a second set.
- Save the file.
- Reload your site and log in again. Everyone else has to do the same.
Keep the single quotes and the semicolon on each line. A missing quote gives a white screen or a parse error: put your backup copy back and try again.
When to change your salts
- After a hack, once the malware and unknown admins are gone.
- When you move host, or someone with a copy of your site leaves.
- When you shared your wp-config.php by accident.
How the keys are made
Random bytes come from crypto.getRandomValues, with uneven bytes thrown away so no character is favoured. Math.random is never used.
FAQ
Will changing my salts log everyone out?
Yes, including you. Old login cookies stop working. We tested this on a fresh WordPress 7.1 site: after wp config shuffle-salts, /wp-admin/ went to the login page, and logging in again worked. Posts, settings and passwords stayed as they were.
How often should I change my salts?
There is no schedule. Change them after a hack, a host move, or when someone with a copy of your site leaves. Otherwise leave them alone.
Are these keys as good as the ones from WordPress.org?
Yes. Same length (64) and same 92 characters. They come from your browser's crypto.getRandomValues. Nothing is sent to us, and the keys are gone when you reload the page.
What if I leave the "put your unique phrase here" lines in wp-config.php?
WordPress keeps working and makes its own values in the database. But the sample text is public, so replace it.
Does a salt change fix a hacked site?
Not alone. It signs everyone out, but does not remove the thief's files or new admin accounts. Remove those and change passwords first, then change the salts.