Generate a Laravel APP_KEY
base64: followed by 32 random bytes in Base64, the format php artisan key:generate writes for Laravel's default AES-256-CBC cipher.
Runs in your browser. Nothing you type is sent anywhere.
The tool is code on this page. It makes no network requests while you use it, stores nothing in cookies or local storage, and keeps working if you go offline after the page loads.
Secret key generator: Laravel
Runs in your browser
Secret
.env line
At a glance
- Variable
- APP_KEY; previous keys in APP_PREVIOUS_KEYS
- Format
- base64: followed by 44 Base64 characters (32 bytes)
- Randomness
- 256 bits
- Requirement
- 32 bytes for AES-256-CBC, the default cipher
The same without a browser
php artisan key:generate --showecho "base64:$(openssl rand -base64 32)"What the secret protects
Laravel's encrypter uses APP_KEY for every value encrypted with the Crypt facade or an encrypted model cast, and for every cookie, including the session cookie. Encrypted values are also signed with a MAC, so a value changed in transit is rejected. Passwords are hashed with bcrypt or Argon2, not encrypted with this key.
What breaks when you change it
Laravel's documentation is direct about it: every signed-in user is logged out, because every cookie is encrypted, and data encrypted with the previous key can no longer be decrypted.
Changing it without signing everyone out
List your previous keys, comma-separated, in APP_PREVIOUS_KEYS. Laravel always encrypts with the current APP_KEY; when decrypting, it tries the current key first and then each previous key. Keep the old key there until data encrypted with it has been re-encrypted or no longer matters.
How Crunu handles this
A separate value for every environment
In Crunu each environment has its own key, sealed separately to each person and machine allowed to read it, so a value generated for staging never travels with production. When you add a variable, Generate in the editor fills it with 40 random letters and digits right in the environment's table, so the value goes into the encrypted environment instead of through a clipboard and a chat window. The server stores values only as ciphertext.
Read about the vaultQuestions about this tool
Found a case the tool gets wrong? Write to support@crunu.com
Why does the key start with base64:?
The prefix tells Laravel to decode the rest into raw bytes. Without it, Laravel would use the text itself as the key, and 44 characters don't make a 32-byte AES-256 key.
Can I print a key without changing my .env file?
Yes: php artisan key:generate --show prints a new key instead of writing it. The command above with openssl gives the same format without PHP.
My APP_KEY was committed to Git. What now?
Treat it as known. Generate a new key, put the old one in APP_PREVIOUS_KEYS only for as long as you need to decrypt existing data, re-encrypt that data with the new key, and then remove the old one.
Read more
Other free tools
- .env linterFinds lines that loaders read differently, values that run as commands when sourced, duplicates and values that look like real keys.
- .env converterTurns a .env file into JSON, YAML, a Docker --env-file or a systemd EnvironmentFile, and back again.
- Compare two .env filesShows which variables exist in only one file and which have different values, with values hidden until you ask.
- OIDC trust policy builderTrust policies and credentials for GitHub Actions, GitLab CI and Bitbucket Pipelines on AWS, Google Cloud and Azure, with the CI snippet.
- Offboarding checklist generatorPick the services someone could reach and get an ordered checklist of what to close and which keys to reissue, with links.
When the values need a home
Crunu is a vault for your team's environment variables and keys. Values are encrypted on your devices, so the server stores them only as ciphertext. Free during early access.