Laravel App Key Generator
Laravel App Key Generator — generated on your device, never transmitted.
Paste into your .env:
This creates 32 random bytes encoded as base64 with the base64: prefix — byte-for-byte the format php artisan key:generate writes into your .env. Generated locally by your browser’s CSPRNG.
Frequently Asked Questions
Is it safe to generate a secret key on a website?
It is here, because nothing is transmitted. The key is produced by crypto.getRandomValues inside your own browser — the same cryptographic generator your operating system uses — and never touches the network. You can disconnect from the internet and this page still works, which is the simplest way to prove it.
Why must the Laravel APP_KEY have a base64: prefix?
Laravel checks for that prefix to know the value is base64-encoded rather than a raw string, and decodes it to get the 32 raw bytes the AES cipher needs. Without it Laravel uses the literal characters as the key, which is the wrong length and throws an error.
Should I use a different key for each environment?
Yes. Development, staging and production must each have their own key. Sharing one means a leak anywhere compromises everywhere, and it lets a token minted in staging be replayed against production.
Where should the key be stored?
In an environment variable or a secrets manager, never in source control. Add your .env file to .gitignore before the first commit — once a secret is in git history, removing it later does not un-leak it, and the key must be rotated.
Does this work on Windows, Mac, iPhone and Android?
Yes. It runs in any modern browser on Windows, Mac, Linux, iPhone and Android with nothing to install and no account needed. Chrome, Edge, Firefox and Safari are all supported.