How to Encrypt Database Fields in Laravel?

There's an easy way to auto-encrypt and decrypt certain fields in Eloquent. Let me show you how it works and share an opinion of WHEN to use it.

- - - - -
Support the channel by checking out our products:

[alexaverkiyev]

Worth mentioning: if you anyhow delete or change your APP_KEY you will never be able to restore any encrypted data, since the same key is used to decrypt it. So be careful.

[bokele]

I really learn everyday new things from you. Thank you for sharing your knowledge. Let us buy the membership.

[mhmdomer]

Thank you, Informative as always!
a quick note here, passwords are "hashed" and not "encrypted"
you cannot recover the plain password from its hash ( hashing is a one way operation ) and it does not make use of any keys ( so passwords will NOT be lost if you changed/lost your APP_KEY )
where as encryption is a two way operation ( encrypt and decrypt using the same key ), hence any encrypted piece of data will be lost if you changed/lost your APP_KEY.

[nickwoolley]

Safer to use one-way hashing with bcrypt for passwords. Useful demo for other fields.

[dmitryvikharev]

To be able to log in and store an encrypted email address, you can add an email_hashed column, for example.
upd. And rewrite login routine )

[Olumasei]

So I am working on a project in which some columns were encrypted in PHP with an encryption key, I am trying to move the web to Laravel, but I keep getting a payload is invalid error when I try to fetch data from this column using Laravel, I am not sure if I am doing something wrong

[JouvaMoufette]

For older versions, I used get/setXAttribute accessors and mutators and the encrypt and decrypt helpers.

For the accessor/get, I would

return $value ? decrypt($value) : '';

so that an empty value would not break the decryption process.

For the mutator/set, I would use

= $value ? encrypt($value) : '';

so that an empty value would not break the decryption process. Also note that this is single equals, as it is assigning and seeing if the assigned value is non-falsy/not empty.

[familyiseverything]

Great vid. Hopefully you can create one on how to search encrypted fields.

[am_yt]

Great Video! Learned a lot, thank you very much.

[eliabekun]

Fantastic! Fantastic! Fantastic! Thank you so much for that information...I love Laravel

[rylanristia]

thanks sir, i really need this for my project... either im in a deadline, big thanks sir...

[pauloclara]

congratulations for the video... but in my case I would like to have an encrypted field but it would be possible later to perform a search on it... any package that can do this? thanks

[Aletreby]

I have an existing legacy database and I need to build a laravel project using this database but I have in the user table the passwords are encrypted with other type rather than bcrypt, so I want to know if there is a way to change checking password with bcrypt type to another type for Login?

[cartaR]

For GDPR security concerns, I did encrypt the e-mail field and I am using the username field for authentication purposes. So now in case of database leakage my database won't provide e-mails to hackers.

[imtayyabhayat]

This is amazing, it was really simple. Thanks

[Ghost-hzdy]

Hello, How to encrypt data with Livewire ? i try to encrypt ID in blade, but wire:click not working, how i can solve this ?

[ZKIUS]

depending on sensitivity of the data you may want to spin up a separate decrypting service unavailable from the world, preferably on another physical machine and with quite strict rate limiting so your main service can't leak the key, of course if you're using symmetric encryption you need to do both things externally, with asymmetrical you can keep the encryption in main API

[maxofficial]

i have used Crypt facade and get/set muttators to do this, is this same or its more secure to use casting?

[adelchellabi]

Thanks but how we can decrypt data inside selectRaw ?

[Stoney_Eagle]

Nice and simple.
Just to clarify, a hidden field will ONLY be displayed when you specifically call it on the model.
So a response json doesn't display it but a manual built API resource will?