I have researched a bit, but I couldn't find a precise answer to why it's possible to write any string in $settings['hash_salt'].

For me it doesn't make sense that the site chashes if no hash salt has been set and if I then go to settings.php and write,

$settings['hash_salt'] = 'x';

the site works just fine.

Why does the site work just because hash salt have any value?


You can read about it in the default.settings.php file:

Salt for one-time login links, cancel links, form tokens, etc.

This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if your site is deployed on a cluster of web servers, you must ensure that this variable has the same value on each server.

For enhanced security, you may set this variable to the contents of a file outside your document root; you should also ensure that this file is not stored with backups of your database.

This value is used by Drupal as salt for some cryptographic operations. It should be a random value. It adds more security to those cryptographic operations (as long as the value is not known by an attacker).

As far as I know Drupal uses a auto-generated salt value based on Database credentials when no salt is set, so Drupal should work without a salt value.


Drupal requires a settings key called hash_salt to secure transient hashes.

It will be generated during Drupal install and added to settings.php. If you use a different settings.php in different environments (for example, a settings.local.php), you may have forgotten to set this variable.

Add a line to your local settings.php like:

$settings['hash_salt'] = 'whatever you like';

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.