WordPress Salts Generator
Free WordPress salts generator — produce the eight AUTH_KEY / SECURE_AUTH_KEY / LOGGED_IN_KEY / NONCE_KEY constants for wp-config.php. Generated locally by a Rust CSPRNG compiled to WebAssembly; nothing is uploaded.
Loading engine…
Runs entirely in your browser — nothing you enter is uploaded or stored.
About WordPress salts
wp-config.php holds eight constants — four keys and four salts — that WordPress mixes into the hashes protecting login cookies and nonces. They are not passwords and you never type them; they exist so that a stolen cookie from one site cannot be replayed against another, and so that a database leak alone is not enough to forge a session.
When to replace them
- After any suspected compromise — it is the fastest way to log out an intruder
- When taking over a site from someone else, alongside rotating passwords
- When a backup or a copy of
wp-config.phphas been shared
Paste the generated block over the existing one, replacing all eight lines. The next request will use the new keys, and every session — including your own — ends immediately.
Frequently asked questions
What are WordPress salts and why regenerate them?
They are eight random keys in wp-config.php that WordPress uses to hash authentication cookies and nonces. Replacing them invalidates every existing login session, which is exactly what you want after a suspected compromise, after handing a site over, or when you are simply not sure who still has a cookie.
Will regenerating salts break anything?
Only sessions. Everyone, including you, is logged out and has to sign in again. Posts, users, passwords and settings are untouched — the salts are used to hash session material, not to encrypt stored data.
Is it safe to generate these in a browser?
These are generated locally by a WebAssembly build of the Rust engine, seeded from the browser CSPRNG. Nothing is sent anywhere — this site has no endpoint that could receive them. Reload the page and you get a completely different set.