Laravel Encrypt and Decrypt
Decrypt a Laravel encrypted value or cookie with its APP_KEY, or encrypt one, using the same AES-256-CBC and HMAC scheme as Crypt::encrypt().
Free · No sign-up · Your inputs stay in your browser
Input
Encrypt or decrypt Laravel encrypted values
Output
Encrypted payload
Laravel's Encrypter: AES-256-CBC with a random IV and an HMAC-SHA256 over iv and value, all wrapped in Base64 JSON. When a payload fails after a deploy, the APP_KEY changed; APP_PREVIOUS_KEYS (Laravel 11+) lets old payloads keep decrypting during a rotation.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
The payload format
Laravel's Encrypter generates a random 16-byte IV, encrypts the serialized value with AES-256-CBC, and computes an HMAC-SHA256 over the Base64 IV and Base64 ciphertext with the same key. The IV, value, MAC and an empty tag are JSON-encoded and the JSON is Base64-encoded. The encryption docs describe the API; the format is in Illuminate\Encryption\Encrypter.
Why decryption fails after a deploy
A 'MAC is invalid' error means the payload was encrypted with a different key, usually because APP_KEY changed. Since Laravel 11, listing old keys in APP_PREVIOUS_KEYS lets existing cookies, sessions and stored values keep decrypting while new ones use the current key.
Handle real keys with care
The APP_KEY decrypts every cookie and session of the application. This page never sends it anywhere, but the sample key is the one to experiment with; read the source of any page before pasting a production key into it.
