WordPress salts
Paste the whole block into wp-config.php, replacing the existing one.
Generated in your browser and never sent anywhere. Reload, or press the button, for a fresh set.
Generated with your browser's cryptographic random source and never sent anywhere. WordPress's own generator is a request to a third party for values that authenticate every session on your site - there is no reason for anyone but you to have seen them.
What these actually do
The four keys and four salts are what WordPress uses to sign authentication cookies and nonces. They are not passwords and you never type them; they simply have to be long, random and secret.
Changing them logs everybody out immediately, including you. That is a feature: it is the fastest way to end every session on a site you think has been compromised, and it is worth doing before you have finished working out whether it was.
When to change them
- After any suspected compromise, before anything else.
- When a site is cloned for staging, so the two do not share session secrets.
- When someone with database access stops working on the site.
- When they are still the defaults or absent. An install copied from another install often carries its parent's.
There is no benefit to rotating them on a schedule. The cost is logging everyone out, and without a reason that is all you get.
A note on the backslash
This generator uses WordPress's own character set minus the backslash. A backslash inside a single-quoted PHP string is an escape character, so a salt ending in one swallows the closing quote and produces a parse error in wp-config.php - a white screen on a site that was fine a moment earlier. It costs a fraction of a bit of entropy out of 64 characters and removes the one way this can break a site.