# What is the `APP_KEY` in Laravel?

> Author: [Oussama Ghaieb](https://oussama.ghaieb.com/about-me)
> Canonical: https://oussama.ghaieb.com/posts/what-is-the-app-key-in-laravel

# <span class="hover:bg-yellow-100">What is the `APP_KEY` in Laravel?</span>

In Laravel, the `APP_KEY` is an essential configuration value found in the `.env` file of your project. It is a 32-character string that serves as the encryption key for the application. Laravel uses this key for several critical functions, such as:

1. **Encrypting Data**: The `APP_KEY` is used by Laravel to encrypt sensitive data, like user information stored in the database or encrypted cookies.
2. **Session Security**: Laravel's encrypted sessions also rely on the `APP_KEY` to ensure their security.
3. **Hashing Tokens**: Any functionality that requires hashing or cryptographic operations, such as password reset tokens, depends on this key.

## Why is `APP_KEY` Important?

If the `APP_KEY` is missing or incorrectly configured:
- Your application might fail to decrypt encrypted data, leading to errors.
- Sensitive operations like session management or data encryption might be compromised.
- Features like API token creation or cookie encryption won’t function properly.

## Setting the `APP_KEY`

The key is usually set during project setup by running the `php artisan key:generate` command, which generates a 32-character random key and automatically sets it in the `.env` file:

```bash
php artisan key:generate
```

The resulting `.env` entry looks like this:

```env
APP_KEY=base64:K1xW5+CRfy/sF8zO7QaJXxT6BXo4OhT8nZqPscMdfGE=
```

The `base64:` prefix indicates that the key is encoded in Base64 format.

---

## Real-World Example

Imagine you have a Laravel application that encrypts user credentials before storing them. Here's how the `APP_KEY` plays a role:

### Encrypting Data
```php
use Illuminate\Support\Facades\Crypt;

// Encrypting sensitive data
$encryptedValue = Crypt::encrypt('Sensitive Information');

// Decrypting the data
$decryptedValue = Crypt::decrypt($encryptedValue);

echo $encryptedValue; // Outputs an encrypted string
echo $decryptedValue; // Outputs: 'Sensitive Information'
```

The `Crypt` facade uses the `APP_KEY` to encrypt and decrypt the data securely. Without the correct key, decryption would fail, leading to errors like "The MAC is invalid."

### Secure Cookies
Laravel also uses the `APP_KEY` to sign cookies. If the key changes, all previously signed cookies become invalid, and users will need to log in again.

---

## Best Practices for `APP_KEY`
1. **Never Share It Publicly**: The `APP_KEY` is sensitive information. Avoid committing it to version control systems like Git.
2. **Do Not Change It in Production**: Changing the key after deploying the application can cause issues with decrypting previously encrypted data.
3. **Use a Secure Generation Method**: Always use `php artisan key:generate` to ensure the key is securely generated.

## Is the `APP_KEY` used to encrypt passwords? 

No, the `APP_KEY` in Laravel is **not used to encrypt passwords**. Instead, Laravel uses secure hashing algorithms for password management, specifically the **bcrypt** algorithm by default. 

Here's a breakdown:

### Password Hashing in Laravel:
- Passwords are hashed using the `bcrypt` hashing algorithm via the `Hash` facade.
- For example:
  ```php
  use Illuminate\Support\Facades\Hash;

  $hashedPassword = Hash::make('plain-text-password');
  ```
- Hashing is a one-way operation, meaning the original password cannot be derived from the hashed value.
- When verifying passwords, Laravel uses `Hash::check()` to compare the plain text input with the hashed value.