Is wp_generate_password() as safe as the salts generated by the recommended https://api.wordpress.org/secret-key/1.1/salt/
As @kaiser said the internal details of API salt generation are not known, but -honestly- the API returns a 64 character string where each character is one of the same 92 possible glyphs used by
Note that if the server has PHP 7, random integers used to pick one of the 92 glyphs is generated using PHP 7 CSPRNG and I doubt that API will have something more stronger that that. In older PHP versions, random values are provided by
Considering this, and considering that strongness of a password resides much more on the encryption algorithm then on the salt used, I can say that, yes,
wp_generate_password is very likely as safe as the salts generated by API.
Is there any downgrade in security by having the salts in the database as this method falls back to that.
For this point, I agree with @kaiser.
Let's assume that someone get a copy of your database dump, done for a backup. In that db dump, they can see your users passwords, but encrypted.
If they have access to salts, is easier to them hack your website.
Moreover, by knowing salt used, user IDs and user metas (where session tokens are stored), is very easy to reproduce nonce values for any of the users, without having to know the "decrypted" password.
Of course, if a malicious user obtains a copy of your database, your security is very compromised anyway, but by storing salts in db, you make life of that malicious user easier.
Does it have any security implications to not set the values and let them be generated randomly on the fly to the db?
If salts aren't set at all, they are generated with
wp_generate_password() only the first time WP tries to access them, then are stored to database and on subsequent requests, they are pulled from there.
As mentioned earlier, salts generated by
wp_generate_password() are not bad per se, but since they are stored in db, the secutity implications are what said in previous point: if someone has access to a copy of your db, it is more dangerous if that db copy contains the salts.
However, the real security implications are when non-secure values are used for salts. In fact, if weak values are set in configuration, WP will not generate any value, but will use that weak values.. In short, if the choose is between no salts in configuration and weak salts, the former is surely better.
Note that in recent versions of WP (not sure since which exact version) the default value
'put your unique phrase here' is ignored, so if
wp-config.php contains that value for any salt, WordPress will ignore it and use a value generated with
wp_generate_password() that is better than a weak value, but worse than a strong value stored in config (because storing salts in db...). Automatically generated values are used even in the case that the same salt value is used for more than once salt.
A change in salts will logout any user logged in your site before the change, including those users that are not logged in in the moment you change but that choosed "remember me" option when logged in before the change.
When WordPress is installed using the "installer" (without manual creation of
wp-config.php) salts values are generated pulling values from API.