Laravel APP_KEY Security: How to Generate, Rotate, and Protect Your Encryption Key

The Problem

How to Fix

1. 1

   Fix "No application encryption key has been specified"

   This exception means APP_KEY is missing or empty in your environment. Laravel cannot encrypt sessions, cookies, or anything using the Crypt facade without it.

   php artisan key:generate

   If configuration is cached, the old empty value persists until you clear it:

   php artisan config:clear

   On a fresh clone this is expected, because .env is gitignored and .env.example ships without a key. On a running production application it is more serious: it means the key was lost, and everything previously encrypted with it is now unreadable.

2. 2

   Fix "The MAC is invalid"

   Same root cause, different symptom. Laravel throws this when it decrypts a value that was encrypted with a different APP_KEY, so the message authentication code does not match.

   It almost always means one of three things: the key was rotated while browsers still hold cookies encrypted with the old one, the application runs on several instances behind a load balancer that do not share an identical APP_KEY, or a deploy replaced .env without carrying the key across.

   Check that every instance agrees on the key, then compare the values:

   php artisan tinker --execute="echo config('app.key');"

   If the key is correct and only some users are affected, those users are holding stale cookies. Clearing the session cookie fixes it for them, and the errors stop on their own as old cookies expire.

3. 3

   Generate a strong APP_KEY

   Use Laravel's built-in command to generate a cryptographically secure key:

   php artisan key:generate

   This sets a base64-encoded 32-byte key in your .env file:

   APP_KEY=base64:abc123...=

   The key must be exactly 32 bytes (256 bits) for AES-256-CBC, which is Laravel's default cipher.

4. 4

   Verify the key is not committed to Git

   Check if APP_KEY has been committed with an actual value:

   git log --all -p -S 'APP_KEY=base64:' -- .env

   If found, the key is compromised. Also check config/app.php:

   // WRONG — hardcoded key
   'key' => 'base64:abc123...',

   // CORRECT — reads from environment
   'key' => env('APP_KEY'),

   Ensure .env is in .gitignore (it is by default in Laravel).

5. 5

   Rotate the key if compromised

   If the APP_KEY was ever exposed:

   1. Generate a new key: php artisan key:generate 2. Clear all sessions: php artisan session:flush (or truncate the sessions table) 3. Re-encrypt any data stored with Crypt::encrypt() 4. Invalidate all signed URLs 5. Clear cache: php artisan cache:clear

   Warning: Changing the APP_KEY means all existing encrypted data becomes unreadable. If you store encrypted data in the database, you need to decrypt with the old key and re-encrypt with the new key before switching.

How to Verify

php artisan tinker
>>> config('app.key')
# Should output: base64:... (44 characters total)
>>> strlen(base64_decode(Str::after(config('app.key'), 'base64:')))
# Should output: 32

Prevention

Frequently Asked Questions