> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Encrypting Environment Files?
- URL: https://securinglaravel.com/security-tip-encrypting-environment/
- Published: 2023-01-17T04:01:03.000Z
- Updated: 2025-01-13T08:19:58.000Z
- Description: [Tip#34] Laravel features the ability to encrypt environment files... but do you need to use it?
- Author: Stephen Rees-Carter
- Tags: Security Tips, Cryptography, Secrets, .env, Environment

A few years ago, [Joe Dixon contributed](https://github.com/laravel/framework/pull/44034?ref=securinglaravel.com) a new feature to Laravel 9 that adds the ability to [encrypt and decrypt .env files](https://laravel.com/docs/11.x/configuration?ref=securinglaravel.com#encrypting-environment-files). The purpose is to allow you to securely manage your app keys/credentials outside your build/deploy pipeline, which can make some pipelines and deployments easier, and lets you track configuration changes securely through version control. It is also fully supported in Laravel Vapor and Forge.

**However,** by default this feature will encrypt your local keys stored in `.env`, which opens up a **huge risk of you accidently using production keys in local dev!**

To avoid this risk, always include the `--env=production` flag when you use this feature. This tells artisan to use the `.env.production` file instead of `.env`. 

In addition, this file should also listed in `.gitignore` so it's ignored by Git. *(Laravel sets this by default.)*

You can do this to encrypt `.env.production` safely:

```
$ php artisan env:encrypt --env=production

  INFO  Environment successfully encrypted.

  Key ........... base64:dw6+haLHKmMIri1BIh02KALvXKrKo3PWa+dro58iVrw=
  Cipher ................................................ AES-256-CBC
  Encrypted file .......................... .env.production.encrypted
```

And then decrypt it **in your production environment** like this to automatically save as `.env`, ready for use:

```
$ php artisan env:decrypt \
    --key="base64:dw6+haLHKmMIri1BIh02KALvXKrKo3PWa+dro58iVrw=" \
    --env=production \
    --filename=".env"

   INFO  Environment successfully decrypted.

  Decrypted file ............................................... .env
```

## But do you need it?

Before reaching for this helper, I would caution you to stop and consider: 

**Do you really need to do this?**

Even though the file is encrypted, you’re still passing around and committing credentials, and this always opens up a potential risk.

- Are you leaving the unencrypted `.env.production` file lying around on your local dev environment?
- Where else are the keys stored?
- Where is the encryption key that decrypts the `.env.production` stored?
- Who has access to the encryption key and should they be able to access production keys?

## Non-Production Usage

While I don’t see much reason to use this in production if you can securely setup your `.env` file directly, I can see it being useful for syncing local dev keys across a dev team, or passing testing keys into CI/build environments. Sandbox keys could easily be configured and then encrypted and committed, locked to specific code versions to avoid version-hell issues.

I’m not saying it’s a useless or insecure feature, just something to use carefully.

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* 

*You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*