# How does the “authentication unique keys and salts” feature work?

I'm trying to find some information on how the authentication keys and salts work in WordPress, but unfortunately I wasn't able to find anything useful. All I got is that the keys should be random, long and different from each other. They should be set in the wp-config.php file because they "greatly increase site's security" by "ensuring better encryption of information stored in the user's cookies".

I actually have some questions, not just one, but I think they should be in one thread because they're closely related.

1. What does the "better encryption of information" mean exactly? I mean in contrast to the situation without the keys.

2. Why do I need 8 keys, and not just one? Judging by the names -- AUTH, SECURE_AUTH, LOGGED_IN, NONCE -- they should set four cookies. One and two for authentication via http and https protocols respectively, three for being logged and 4... I have no idea what that would be for.

3. Why do I need keys and salts? Wouldn't that work just for keys? They pretty long and random, so what is the purpose of additional salts in this case?

4. I've read another question (I don't remember exactly where that was) and there was info that if you delete the keys and salts from wp-config.php file, they will be stored in the WordPress database under wp_options table. And that's true, I've tested that, the keys were created and put into the table. But what would happen when I restored the (different) keys in the wp-config.php file? Will the two keys from the wp-config.php file and the database be combined into one, as the question suggested, or just one of them will be used, if so, which one?

5. What actually happens when a user visits my blog? He has an account, see the main page and log into the system, and what's next? I mean what happens with the keys, cookies (and everything else) in this time? What is the exact process of logging into a WordPress website?

6. What is the best size of the keys? The default one is 64 characters. Is there any limit here?

7. Can I put whatever character in the keys (of course, without ')? Can I use foreign language characters, for instance, ó or Ż? What about © and others?

1. Basically, they're hashing salts. They're used to make the results of hashing much less predictable. See https://en.wikipedia.org/wiki/Salt_(cryptography) for info on salts.

2. AUTH is used for the /wp-admin authentication cookie, SECURE_AUTH is for the same when using SSL, LOGGED_IN is used for identification to the "front-end" of the site. NONCE is used for the nonces that WordPress generates to guard against CSRF attacks.

3. The KEY and SALT for each scheme are combined to make the actual salt used. The wp_salt function checks for duplicated strings here to ensure that they are not the same, and to generate random strings if they are.

4. WordPress preferentially uses the values in the wp-config.php file. If they are not available or are duplicates of one another, random data is generated and stored in the database. But the values defined in the wp-config.php take precedence.