What the keys and salts do
WordPress uses eight secret values in wp-config.php to sign and hash its login cookies and nonces: AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and a matching salt for each. Long random values make those cookies impossible to forge.
Each value here is 64 characters long, drawn from the same character set WordPress uses for its own salts. Unlike the official salt service, which generates values on WordPress.org’s servers, these are created in your browser.
Replacing your salts
- Open wp-config.php and find the block of eight define() lines.
- Replace the whole block with the output above.
- Save the file. Every user, including you, is logged out and has to sign in again.
Changing salts is a quick way to force everyone to log out after a suspected compromise. Pair it with password resets for administrator accounts.
Frequently asked questions
Is it safe to change WordPress salts?
Yes. Nothing is lost except active login sessions. Everyone simply signs in again.
What is the .env format for?
Setups like Bedrock, Docker images and some hosts read these values from environment variables. Choose .env to get KEY=’value’ lines instead of PHP define() calls.