What APP_KEY does
Laravel’s APP_KEY encrypts cookies, sessions and any values you pass to the encrypter. The default cipher, AES-256-CBC, needs exactly 32 random bytes, which Laravel stores Base64 encoded with a base64: prefix. This generator produces the same format as php artisan key:generate.
With the project at hand, the artisan command is the usual route. This tool helps when you are filling in environment variables in a hosting dashboard, a CI system or a container before the code is deployed.
Rotating the key
Changing APP_KEY makes existing encrypted data unreadable and logs users out. Since Laravel 11 you can list old keys in APP_PREVIOUS_KEYS, separated by commas, so Laravel can still decrypt data made with them while new data uses the new key.
Frequently asked questions
Why does the key start with base64:?
The cipher needs raw bytes. The base64: prefix tells Laravel to decode the rest of the value before using it.
Which cipher should I choose?
Keep AES-256-CBC, the Laravel default, unless your config/app.php sets the cipher to AES-128-CBC. The key length has to match the cipher.