I was trying to figure out where does WordPress store all the nonces. But wasn\'t able to find a clue. I first checked the database but wasn\'t able to find any table named some
Nonces are not stored directly anywhere, they are created using the function wp_create_nonce and validated using the wp_verify_nonce.
Those functions in turn use wp_hash
to hash together a lifespan, a custom string, the user_id and the session token stored in wp_usermeta with the key session_tokens
.