AES-256, the default
- Input
- 32 bytes
- Expected output
- base64: + 44 caracteres (51 no total)
256 bits of entropy.
Carregando ferramenta… / Loading tool…
generate laravel app key
In the generator, open Laravel APP_KEY: the APP_KEY=base64:... line comes out ready to paste into .env. When artisan is at hand, the equivalent command shows right under the result.
256 bits of entropy.
128 bits of entropy.
The + / = characters of base64 need no quotes.
Handy to copy the value without touching .env.
Keeps old sessions and data readable.
Use at least 32 random bytes (256 bits): RFC 7518, section 3.2, says the HMAC key must be the size of the hash output or larger, that is 256 bits for HS256, 384 for HS384 and 512 for HS512. A short phrase or dictionary word as the secret can be cracked by offline brute force from a single token.
The key is not the size the cipher asks for (32 bytes for AES-256, 16 for AES-128) or the base64: prefix was lost. Generate it again in the right format and clear the config cache.
Technically yes, but you should not: a key leaked in development would then decrypt production data. Use one key per environment.
Neither. It encrypts and signs data of the app itself, such as cookies and Crypt values. User passwords use a separate hash, and the database password lives in DB_PASSWORD.
Random bytes in hexadecimal: 2 characters per byte. 32 bytes give 64 characters and 256 bits.
openssl rand -hex 32python3 -c "import secrets; print(secrets.token_hex(32))"Pick the variables and copy the block. Each generation draws new values; values with $, # or spaces come out quoted.
Turn on at least one variable.
For production, prefer generating locally with the terminal command. Any secret typed or copied from a web page should be treated as exposed if you do not trust the device or the browser extensions. Nothing here is sent or stored.