Laravel APP_KEY Security: How to Generate, Rotate, and Protect Your Encryption Key

The Problem

How to Fix

1. 1

   Generate a strong APP_KEY

   Use Laravel's built-in command to generate a cryptographically secure key:

   php artisan key:generate

   This sets a base64-encoded 32-byte key in your .env file:

   APP_KEY=base64:abc123...=

   The key must be exactly 32 bytes (256 bits) for AES-256-CBC, which is Laravel's default cipher.

2. 2

   Verify the key is not committed to Git

   Check if APP_KEY has been committed with an actual value:

   git log --all -p -S 'APP_KEY=base64:' -- .env

   If found, the key is compromised. Also check config/app.php:

   // WRONG — hardcoded key
   'key' => 'base64:abc123...',

   // CORRECT — reads from environment
   'key' => env('APP_KEY'),

   Ensure .env is in .gitignore (it is by default in Laravel).

3. 3

   Rotate the key if compromised

   If the APP_KEY was ever exposed:

   1. Generate a new key: php artisan key:generate 2. Clear all sessions: php artisan session:flush (or truncate the sessions table) 3. Re-encrypt any data stored with Crypt::encrypt() 4. Invalidate all signed URLs 5. Clear cache: php artisan cache:clear

   Warning: Changing the APP_KEY means all existing encrypted data becomes unreadable. If you store encrypted data in the database, you need to decrypt with the old key and re-encrypt with the new key before switching.

How to Verify

php artisan tinker
>>> config('app.key')
# Should output: base64:... (44 characters total)
>>> strlen(base64_decode(Str::after(config('app.key'), 'base64:')))
# Should output: 32

Prevention

Frequently Asked Questions