Laravel APP_KEY and Secret Generator
Generate a Laravel APP_KEY in the base64: format, or a hex token, a URL-safe token or a password, from a secure random source.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a secret
32 random bytes, Base64-encoded with the base64: prefix: the format php artisan key:generate writes for AES-256-CBC.
Output
Press Generate
Generated with crypto.getRandomValues, the browser's cryptographically secure generator. Put it straight into your .env or secret manager; never commit it to Git.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
What APP_KEY is for
Laravel uses APP_KEY to encrypt cookies, sessions and anything passed through the Crypt facade, and to sign URLs. The default cipher is AES-256-CBC, which needs exactly 32 bytes, so the key is 32 random bytes encoded as Base64 with a base64: prefix.
Rotating it
Changing the key logs everyone out and makes previously encrypted values unreadable. Laravel 11 and later can decrypt with old keys listed in APP_PREVIOUS_KEYS while new values use the new key, so a rotation does not have to be a cliff edge.
Prefer artisan when you can
On a server you control, php artisan key:generate does the same thing and writes the result into .env. This tool is for the times you cannot run it: a CI secret, a container environment or a deployment dashboard.