{"id":"04febb9eb3335147","repo":"laravel/framework","slug":"unsupported-cipher-or-incorrect-key-length-suppor","errorCode":null,"errorMessage":"Unsupported cipher or incorrect key length. Supported ciphers are: {$ciphers}.","messagePattern":"Unsupported cipher or incorrect key length\\. Supported ciphers are: (.+?)\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"src/Illuminate/Encryption/Encrypter.php","lineNumber":61,"sourceCode":"        'aes-256-gcm' => ['size' => 32, 'aead' => true],\n    ];\n\n    /**\n     * Create a new encrypter instance.\n     *\n     * @param  string  $key\n     * @param  string  $cipher\n     *\n     * @throws \\RuntimeException\n     */\n    public function __construct(#[\\SensitiveParameter] $key, $cipher = 'aes-128-cbc')\n    {\n        $key = (string) $key;\n\n        if (! static::supported($key, $cipher)) {\n            $ciphers = implode(', ', array_keys(self::$supportedCiphers));\n\n            throw new RuntimeException(\"Unsupported cipher or incorrect key length. Supported ciphers are: {$ciphers}.\");\n        }\n\n        $this->key = $key;\n        $this->cipher = $cipher;\n    }\n\n    /**\n     * Determine if the given key and cipher combination is valid.\n     *\n     * @param  string  $key\n     * @param  string  $cipher\n     * @return bool\n     */\n    public static function supported(#[\\SensitiveParameter] $key, $cipher)\n    {\n        if (! isset(self::$supportedCiphers[strtolower($cipher)])) {\n            return false;\n        }","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/laravel/framework/blob/bd6b5437e6ad87bb49f9b426724f07a9f64e9683/src/Illuminate/Encryption/Encrypter.php#L43-L79","documentation":"Encrypter constructor throws RuntimeException when the (key, cipher) pair fails static::supported(). supported() checks that the cipher is one of aes-128-cbc/aes-256-cbc/aes-128-gcm/aes-256-gcm AND that the raw key length matches (16 or 32 bytes). The message lists the valid ciphers. A misconfigured APP_KEY or cipher is the canonical cause.","triggerScenarios":"Instantiating new Encrypter($key, $cipher) or booting the EncryptionServiceProvider when APP_KEY length does not match the configured cipher (e.g. APP_KEY is a 32-char ASCII string but cipher is aes-128-cbc, or APP_KEY is empty/malformed). Note: Laravel's 'base64:' prefix decodes to raw bytes; a plain hex/ascii key without prefix is taken literally.","commonSituations":"Fresh deploy missing APP_KEY; key generated for one cipher then cipher changed in config/app.php; copying .env between projects; truncated APP_KEY; using a hex string instead of base64-encoded random bytes; setting previous_keys to a wrong-length key.","solutions":["Regenerate the key for the chosen cipher: php artisan key:generate (it base64-encodes 32 random bytes, matching aes-256-cbc).","Ensure config('app.cipher') matches the key size: aes-128-* needs a 16-byte key, aes-256-* needs 32 bytes.","If you set a raw key, prefix with 'base64:' and confirm base64_decode yields 16 or 32 bytes.","When calling previousKeys(), pass only keys whose length matches the current cipher."],"exampleFix":"// before — key/cipher mismatch\n// .env: APP_KEY=abc123            (too short)\n// config/app.php: 'cipher' => 'aes-256-gcm',\n\n// after\n// shell:\n// $ php artisan key:generate\n//   Application key set successfully.\n// .env: APP_KEY=base64:aaaaBBBB....(== 44 chars base64 => 32 raw bytes)\n// config/app.php: 'cipher' => 'aes-256-gcm',","handlingStrategy":"validation","validationCode":"use Illuminate\\Encryption\\Encrypter;\n\n$key = config('app.key');\n$cipher = config('app.cipher');\nif (! Encrypter::supported($key, $cipher)) {\n    throw new \\RuntimeException('APP_KEY / cipher mismatch — run php artisan key:generate');\n}","typeGuard":"function appKeyValidForCipher(): bool\n{\n    return \\Illuminate\\Encryption\\Encrypter::supported(config('app.key'), config('app.cipher'));\n}","tryCatchPattern":null,"preventionTips":["Always generate keys with php artisan key:generate (correct length, base64-encoded).","Keep APP_KEY and cipher consistent across all environments.","Validate previous_keys lengths against the configured cipher."],"tags":["encryption","configuration","app-key","bootstrap","security"],"analyzedSha":"bd6b5437e6ad87bb49f9b426724f07a9f64e9683","analyzedAt":"2026-08-06T00:28:32.783Z","schemaVersion":2}