Generate the eight WordPress authentication keys and salts (AUTH_KEY to NONCE_SALT) with your browser's cryptographic random number generator. Copy them as wp-config.php lines, a .env file, Docker variables or JSON, or paste your wp-config.php to swap them in automatically.
Last updated:
Paste this into wp-config.php
Copy keys one by one
Constant
Value
Copy
Update an existing wp-config.php
Paste the contents of your wp-config.php. The tool replaces the eight key and salt lines with the new values (and adds any that are missing) without touching anything else. The file never leaves your browser.
Advertisement
Advertisement
How to use the WordPress Salt Generator
Choose the output format: wp-config.php for a normal install, .env for Bedrock-style projects, or Docker variables for the official WordPress image.
Keep the default characters and length (92 symbols, 64 characters) unless your deployment tool has trouble with spaces or $ signs; then pick the shell-safe set.
Press Generate new salts and then Copy all or Download.
Replace the old block in wp-config.php (the lines that start with define( 'AUTH_KEY' … to NONCE_SALT), or paste the whole file into Update an existing wp-config.php and download the updated copy.
Upload the file to your server. All users, including you, are logged out and simply sign in again.
The eight WordPress keys and what they protect
Key
Matching salt
Used for
AUTH_KEY
AUTH_SALT
The authentication cookie for the admin area over plain HTTP
SECURE_AUTH_KEY
SECURE_AUTH_SALT
The authentication cookie sent only over HTTPS
LOGGED_IN_KEY
LOGGED_IN_SALT
The logged-in cookie that marks you as signed in on the front end
NONCE_KEY
NONCE_SALT
Nonces: short-lived tokens that protect forms and links against forged requests
WordPress combines each key with its salt (key . salt) and uses the result as the secret for an HMAC of the cookie or nonce data. If a constant is missing or still says put your unique phrase here, WordPress falls back to random values stored in the database, which works but is weaker if the database leaks.
Where the keys go
Classic install: open wp-config.php in the site root and replace the block between Authentication unique keys and salts and /**#@-*/.
Bedrock and Dotenv setups: put the lines in .env; the config file reads them with env('AUTH_KEY').
Official WordPress Docker image: set WORDPRESS_AUTH_KEY through WORDPRESS_NONCE_SALT in the container environment and the image writes them into wp-config.php.
Keep wp-config.php out of public Git repositories, and never reuse the same salts across sites.
How strong are the keys?
Entropy per key = length × log2(number of symbols). With the defaults that is 64 × log2(92) ≈ 418 bits. The shell-safe set (88 symbols) gives about 413 bits and letters and digits only (62 symbols) about 381 bits at 64 characters. All of these are far beyond any brute-force attack; length matters much more than the symbol set.
Frequently asked questions
What are WordPress salts and security keys?
They are eight secret random strings defined in wp-config.php. WordPress mixes them into the hashes that sign login cookies and nonces, so a cookie cannot be forged or reused without knowing the keys. Four are called keys (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY) and four are salts (AUTH_SALT, SECURE_AUTH_SALT, LOGGED_IN_SALT, NONCE_SALT).
What happens when I change the salts?
Every existing login cookie becomes invalid, so all users are logged out and must sign in again. Posts, settings, passwords and the database are not affected. That makes changing salts a quick first step after a suspected break-in.
Are these keys as secure as the official WordPress generator?
Yes. They use the same 92 characters and default length of 64, giving about 418 bits of randomness per key, and they come from crypto.getRandomValues, the browser's cryptographically secure random generator. Bytes that would bias the result are discarded.
Can the keys contain spaces and symbols?
Yes, and WordPress handles them fine inside the single quotes of define(). The default set never contains a single quote or backslash, so nothing needs escaping. If a deployment script or .env parser has trouble with spaces, $, # or backticks, choose the shell-safe set.
How often should I rotate WordPress salts?
There is no fixed rule. Change them after a hack or malware clean-up, when someone with server access leaves, if wp-config.php may have leaked, or as part of regular maintenance if you do not mind logging everyone out.
Can I change salts with WP-CLI instead?
Yes. On a server with WP-CLI, the command wp config shuffle-salts writes new values into wp-config.php. This page is useful when you edit the file by hand, use environment variables, or do not have shell access.
Are the generated salts saved anywhere?
No. They are created in your browser and never sent or stored. Only your format and character choices are remembered on this device. A pasted wp-config.php is also processed only in the page.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.