WordPress authentication keys and salts add unpredictable secret values to login cookies and security tokens. This generator creates the eight standard constants used in wp-config.php with cryptographically secure randomness inside your browser.
Generate a fresh set of eight keys, then replace the matching lines in wp-config.php.
How this tool helps
Replacing old keys immediately signs out existing sessions. This can be useful after a security incident, a team change, or the accidental exposure of wp-config.php. Always edit the file through a safe hosting tool or secure file connection and keep a backup before changing production configuration.
How to use it
- Select Generate new keys.
- Copy all eight define lines.
- Open wp-config.php and find the existing authentication key and salt section.
- Replace the complete section, save the file, and sign in again.
Frequently asked questions
Are the keys sent to WPWala?
No. The browser generates the values locally and the tool does not submit them to the server.
Will changing salts delete website content?
No. It invalidates existing login cookies but does not remove posts, media, settings, or users.
How often should WordPress salts be changed?
There is no universal schedule. Change them when configuration may have been exposed, after a security incident, or when you need to invalidate all sessions.
Important: Review generated configuration before using it on a production website and confirm detector results against the website you are researching.