One of my clients' webhosts posted the SITE_KEY of their site on a publicly accessible webpage. How do I generate a new SITE_KEY with the same random process that generated the original?


Any source of unknown data should be fine - I'd use a command like this just because it's quicker:

head -n 1000 /dev/urandom | md5sum
  • NB: "it's quicker" isn't great criteria for cryptographic RNG - but I do think this will give you a very hard to predict key Jun 15 '15 at 22:33

There is no requirement to generate the SITE_KEY in the same way. (In fact, the algorithm changed in v4.6.3.) Rather, follow these requirements:

  • Stick to alphanumerics
  • Provide decent entropy (I think 90 bits would be decent, but there's no downside to going higher)

For some better ways to generate a SITE_KEY:

  • On Debian/Ubuntu-based systems, run: sudo apt-get install makepasswd && makepasswd --chars=32 (~190 bits)
  • Use mkpasswd.php from civicrm-buildkit, eg: mkpasswd.php 32 (~190 bits)
  • Do something closer to v4.6's algorithm: php -r 'echo md5(rand() . mt_rand() . rand() . uniqid("", TRUE) . "www.example.org") . "\n";' (~128 bits)

Random Tip: If you use an authenticated SMTP service for mail delivery and you change the SITE_KEY, then you may need to re-enter the SMTP password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.