Regularly updating your keys and salts is a good security practice — we recommend at least once every three months. When you change these values, all users will be logged out of your site. That's because their cookies, now encrypted with a different key and salt, will be invalid. This can be particularly useful if you suspect a security breach.