Laravel Signed URL Verifier
Check why a Laravel signed URL is rejected, or sign a URL yourself: the signature is the HMAC-SHA256 of the URL with your APP_KEY, as URL::signedRoute computes it.
Free · No sign-up · Your inputs stay in your browser
Input
Verify or create a Laravel signed URL
Output
Expected signature
URL::signedRoute and temporarySignedRoute append signature = hash_hmac('sha256', the full URL with its query string, APP_KEY), with expires added first for temporary links. Validation rebuilds the URL without signature, so a proxy that changes the scheme or host (http behind a TLS-terminating load balancer) breaks every link until TrustProxies is set. Rotating APP_KEY invalidates links unless the old key is in APP_PREVIOUS_KEYS.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Why valid links fail
The signature covers the full URL, scheme and host included. Behind a load balancer that terminates TLS, the application sees http:// unless trusted proxies are configured, signs or checks the wrong string, and every link fails with 403 Invalid signature. Query parameters added by email trackers have the same effect; ignore them with the relative option or a list of ignored parameters. See Laravel's signed URL documentation.
Key rotation
Changing APP_KEY invalidates every outstanding signed link unless the old key is listed in APP_PREVIOUS_KEYS, which Laravel checks as a fallback.
