WordPress Salt Key Generator

Generate all eight secure wp-config.php keys and salts in your browser, as PHP, .env or JSON.

---

WordPress uses eight secret values — four keys and four salts — to encrypt the cookies that keep you logged in. If they are weak, old, or copied from a tutorial, anyone who learns them can forge login cookies. This generator makes all eight in your browser using the cryptographic random number generator your device already has.

How to use it

1. Pick the format you need: PHP define() lines for wp-config.php, an .env file for Bedrock-style setups, or JSON.
2. Choose a key length. 64 characters is the WordPress default; go longer if you like.
3. Press Generate new keys until you are happy, then copy the result.
4. Open wp-config.php, find the existing block of eight define lines and replace it with the new block.

What changes when you replace them

Every logged-in user, including you, is signed out the moment the new values go live, because their existing cookies no longer validate. That is exactly what you want after a hack, a developer leaving the team, or a site migration — it invalidates every stolen session at once. Passwords are not affected.

How it works

Each character is chosen with crypto.getRandomValues, using rejection sampling so that no character is more likely than another. The symbol set leaves out quotes, backslashes, dollar signs and spaces, so the output can be pasted straight into a PHP single-quoted string without escaping.

Questions people ask

Is this the same as the official WordPress.org salt service?

It does the same job, but nothing leaves your browser, so there is no request to a third party and no chance of the values being logged on the way.

How often should I change salts?

After any security incident, after a staff or contractor change, and whenever you copy a site to a new environment. Some site owners rotate them every few months.

Can I use the same salts on staging and live?

No. Generate a fresh set for each environment so a cookie from one cannot be used on the other.

Do I need all eight?

Yes. WordPress expects all eight constants to be defined and non-empty. This tool runs entirely inside your web browser. Nothing you type is uploaded to a server, so there is no queue and no copy of your data left behind when you close the tab.