WordPress Salt Key Generator

WordPress uses eight secret keys in wp-config.php to sign the cookies that keep you logged in. Replacing them invalidates every active session on the site immediately.

These are generated by your own browser using the Web Crypto API. Nothing is sent to this site or anywhere else, so nobody but you ever sees them.

Paste into wp-config.php 

	

	
		

			
How to use these

			
    
				
  1. Open wp-config.php in the root of your WordPress install.
    2. 
				
  2. Find the block of eight lines starting with AUTH_KEY.
    3. 
				
  3. Delete those eight lines and paste these in their place.
    4. 
				
  4. Save. Everyone gets logged out, which is the point: existing session cookies stop working immediately.
    5. 
			

			
Worth doing if you suspect a compromise, after removing malware, or when a developer with access moves on.