Free · Private · Client-side

Laravel APP_KEY Generator

Generate secure application encryption keys for Laravel projects. These keys are used for encrypting cookies, sessions, and other sensitive data.

Generated values never leave this device.

Formatbase64:<32 bytes>

CipherAES-256-CBC

Estimated entropy: 256 bits · 32 random bytes~132,943,112,026,157,700,000,000,000,000 quintillion times the age of the universe to crack

Weak · <50 bitsFairGood · 70+Strong · 100+

In plain terms: a gaming PC guessing a million passwords per second would need 132,943,112,026,157,700,000,000,000,000,000,000 quintillion times the age of the universe. Even someone renting every cloud server on Earth — a trillion guesses per second — would need 132,943,112,026,157,700,000,000,000,000 quintillion times the age of the universe. Nobody is guessing this password; the only realistic risks are it being reused or phished.

Generated keys

Strong256 bits

Add to .env File

.env

APP_KEY=base64:...

Why Laravel Needs APP_KEY

Encrypts session data to prevent tampering
Secures cookies containing sensitive information
Used by Laravel's encryption facade for encrypt() and decrypt()
Protects CSRF tokens and other security features
Required for signed URLs and password reset tokens

Bulk Generation

Generatekeys

Generate Locally

The recommended way is to use Laravel's built-in command:

Laravel Artisan (preferred)

$php artisan key:generate

OpenSSL

$echo "base64:$(openssl rand -base64 32)"

PHP CLI

$php -r "echo 'base64:' . base64_encode(random_bytes(32)) . PHP_EOL;"

How to install your APP_KEY

Copy the key

Click on any generated key above to copy it to your clipboard.

Update your .env file

Paste the key as the value of APP_KEY in your Laravel project's .env file.

Clear config cache (if needed)

Run "php artisan config:clear" so Laravel picks up the new key.

Production Warning

Changing APP_KEY in production will invalidate all encrypted data, including user sessions, cookies, and any data encrypted with the old key. Only change it during initial setup or if you suspect the key has been compromised.

API key & secret handling best practices →