WordPress salt generator

What it does

WordPress uses eight secret values in wp-config.php to sign the cookies that keep people logged in: four keys (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY) and four salts with matching names. This generator makes a fresh set of all eight, 64 characters each, using the same character set as WordPress's own generator. It leaves out the single quote and backslash, so every value can sit inside PHP single quotes without escaping. You can copy the lines as PHP define() calls, as a .env file for Bedrock-style setups, or as YAML.

How to use it

1. Choose the output format. Most sites need the wp-config.php lines.
2. Copy the block, or download it as a file.
3. Open wp-config.php in the site root and find the lines that start with define( 'AUTH_KEY'.
4. Replace all eight lines with the new ones and save the file.
5. Log in again. Everyone else will be asked to log in again too.

Press "Generate new keys" for a different set. Nothing is kept once you leave the page.

How to read the result

With the default format the output is eight lines, each in the form define( 'AUTH_KEY', '…64 characters…' );, lined up so the values start in the same column. The Strength stat reads about 418 bits for each value: 64 characters, each picked uniformly from a 92-character set. That is far beyond what anyone could guess, so the only real risk is the file itself leaking.

The values look messy on purpose. Spaces, brackets and symbols are all valid, because they sit inside single quotes. If an editor or deployment tool changes them, for example by turning a straight quote into a curly one, PHP will throw a syntax error and the site will show a blank page. Paste into a plain text editor or over SSH, not into a word processor.

In the .env format each line reads AUTH_KEY='…'. Keep the single quotes; without them, characters such as # and $ can be read as a comment or a variable.

Salts are one small part of keeping a WordPress site safe. Updates, backups and monitoring matter more, and our website maintenance service handles all three. For other secrets, such as admin passwords, use the password generator.