Generate a complete set of unique security keys (salt) for the wp-config.php file. Copy the ready block and replace the existing key definitions in your WordPress installation. The keys are randomized entirely in your browser with a cryptographic random number generator and are never sent anywhere. Every click creates a new set.
copied
🔒 Keys randomized in your browser (Web Crypto API). Nothing is sent or stored.
⚠ Changing the keys logs out all logged-in users, including you. This is normal. Back up wp-config.php before editing.
Paste the block into wp-config.php, replacing the existing section from AUTH_KEY to NONCE_SALT. The file is in the root directory of your WordPress installation.
What salt keys are and why they matter
Salt keys are eight random, long strings defined in the wp-config.php file: AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and four matching salts. WordPress uses them to encrypt the information stored in session cookies. Thanks to them, the cookie of a logged-in user is very hard to forge, even if someone learns a fragment of it. It is a simple yet important element of WordPress security that should be set to unique, random values in every installation.
How to replace the keys step by step
1. Back up the fileDownload the wp-config.php file from the root directory via FTP or your hosting file manager and keep a copy. That is your way back in case of a mistake.
2. Generate the blockClick "Generate new keys" and copy the whole block of eight definitions. Each set is unique and random.
3. Replace in wp-configIn the file, find the section from define('AUTH_KEY', ...) to define('NONCE_SALT', ...) and replace it with the pasted block. Save the file.
4. Log in againAfter saving, all sessions are invalidated. Log in to the panel again. This confirms the new keys work. Part of routine login protection.
When it is worth changing the keys
There is no need for routine, periodic key changes. A replacement makes sense in specific situations: after a suspected or confirmed breach (it revokes access from an intruder who may have captured a session cookie), after ending cooperation with an external contractor who had file access, and when you want to log everyone out at once, for example after changing access rules. Otherwise, strong, random keys set once fully serve their purpose. Changing the keys is also one of the steps in the post-breach procedure, alongside updates and restoring a backup.
Frequently asked questions about salt keys
Eight random strings (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and their salts) that WordPress uses to encrypt data in session cookies. They make it hard to forge a logged-in user's cookie.
Open wp-config.php in the root directory, find the section with AUTH_KEY and the following keys, and replace it with the generated block. The change takes effect on save. Back up the file first.
All active sessions are invalidated, so everyone logged in (including you) is logged out. This is intended, useful after a suspected breach to revoke an intruder's access.
Yes. They are randomized in the browser with a cryptographic generator (Web Crypto API) and never sent or stored. Every click creates a new, unique set.
No routine changes needed. Replace them after a suspected breach, after an external contractor's work, or when you want to log everyone out. Otherwise strong keys are enough.
Tool and write-up: Marcin Szewczyk-Wilgan, WebOptimo. Keys randomized cryptographically in the browser, with nothing sent to a server.
Contact
We will take care of your site's security
WordPress hardening, login protection, post-breach audits and site care. No obligation — a concrete proposal after a short conversation.
