Security Keys in WordPress are a string of random characters used for authorization and encryption of cookies generated by WordPress. These security keys can be defined by user in the wp-config.php file at any point in time. During initial installation, it is not necessary for a user to provide these keys to install or run WordPress. If a user does not provide these keys in their wp-config.php file, then WordPress automatically generates these keys.
Example:
define('AUTH_KEY', 'put your unique phrase here');
define('SECURE_AUTH_KEY', 'put your unique phrase here');
define('LOGGED_IN_KEY', 'put your unique phrase here');
define('NONCE_KEY', 'put your unique phrase here');
define('AUTH_SALT', 'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT', 'put your unique phrase here');
define('NONCE_SALT', 'put your unique phrase here');
You can generate your own from WordPress key generator.
The benefit of including these keys is that by deleting or resetting them a WordPress admin can force logout for all logged in users.
There are currently four security keys AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY and NONCE_KEY. To further strengthen these keys a layer of SALTs is added to them which is kind of like an extra password for these keys.
