WordPress salt and security key generator

What these are for

WordPress signs the cookie that keeps you logged in with eight secret values kept in wp-config.php: four keys and four salts. Nobody types them and nobody needs to remember them. They only have to be long, random and known to no one else.

Changing them makes every existing login cookie worthless. Everyone who is logged in, on every device, is logged out at once and has to log in again. Nothing else about the site changes.

When to change them

• After a break-in, once the passwords have been changed. It logs the intruder out. How to remove malware from a hacked WordPress site puts it in order with the other steps.
• When someone who had access to the site's files no longer should.
• When wp-config.php still holds the words "put your unique phrase here", which means the site has been running on values anyone can read in WordPress's sample file.

How to use them

1. Open wp-config.php in the site's main folder, in your host's file manager or over SFTP. Keep a copy of the file as it is.
2. Find the eight lines that begin define( 'AUTH_KEY' and end with NONCE_SALT.
3. Replace all eight with the eight lines above, and save.
4. Reload the site and log in again.

How they are made

Your browser makes them on this page, using its own source of random numbers for cryptography. Each is 64 characters from the set WordPress itself uses. They are not sent to us or to anyone else, and they are gone when you close the tab.

If you would rather not take any web page's word for that, make them on your own server instead. With WP-CLI, wp config shuffle-salts writes a new set straight into wp-config.php.