Laravel Weak Encryption Cipher: How to Ensure AES-256-CBC Is Configured Correctly

The Problem

How to Fix

1. 1

   Verify your cipher configuration

   Check config/app.php:

   'cipher' => 'AES-256-CBC',

   This should be exactly AES-256-CBC (the Laravel default). If you see AES-128-CBC, DES, or any other value, change it back.

   Also verify via artisan:

   php artisan tinker
   >>> config('app.cipher')
   # Should output: AES-256-CBC

2. 2

   Ensure your APP_KEY matches the cipher

   AES-256-CBC requires a 32-byte key. AES-128-CBC requires a 16-byte key.

   Verify your key length:

   php artisan tinker
   >>> strlen(base64_decode(Str::after(config('app.key'), 'base64:')))
   # Should output: 32 for AES-256-CBC

   If the key length is wrong, generate a new key:

   php artisan key:generate

   Warning: Regenerating the key invalidates all existing encrypted data and sessions.

3. 3

   Do not override the cipher in environment files

   Check that .env does not contain a cipher override:

   grep -i cipher .env

   The cipher should only be set in config/app.php, not in .env. If present in .env, remove it and let the config file handle it:

   // config/app.php — correct
   'cipher' => 'AES-256-CBC',

   // Do NOT put in .env
   // APP_CIPHER=AES-128-CBC  ← remove this

How to Verify

php artisan tinker
>>> encrypt('test')
# Should return a long encrypted string
>>> decrypt(encrypt('test'))
# Should return: test

Prevention

Frequently Asked Questions