{"id":"6f513e377055710d","repo":"laravel/framework","slug":"could-not-encrypt-the-data","errorCode":null,"errorMessage":"Could not encrypt the data.","messagePattern":"Could not encrypt the data\\.","errorType":"exception","errorClass":"EncryptException","httpStatus":null,"severity":"error","filePath":"src/Illuminate/Encryption/Encrypter.php","lineNumber":114,"sourceCode":"     * Encrypt the given value.\n     *\n     * @param  mixed  $value\n     * @param  bool  $serialize\n     * @return string\n     *\n     * @throws \\Illuminate\\Contracts\\Encryption\\EncryptException\n     */\n    public function encrypt(#[\\SensitiveParameter] $value, $serialize = true)\n    {\n        $iv = random_bytes(openssl_cipher_iv_length(strtolower($this->cipher)));\n\n        $value = \\openssl_encrypt(\n            $serialize ? serialize($value) : $value,\n            strtolower($this->cipher), $this->key, 0, $iv, $tag\n        );\n\n        if ($value === false) {\n            throw new EncryptException('Could not encrypt the data.');\n        }\n\n        $iv = base64_encode($iv);\n        $tag = base64_encode($tag ?? '');\n\n        $mac = self::$supportedCiphers[strtolower($this->cipher)]['aead']\n            ? '' // For AEAD-algorithms, the tag / MAC is returned by openssl_encrypt...\n            : $this->hash($iv, $value, $this->key);\n\n        $json = json_encode(['iv' => $iv, 'value' => $value, 'mac' => $mac, 'tag' => $tag], JSON_UNESCAPED_SLASHES);\n\n        if (json_last_error() !== JSON_ERROR_NONE) {\n            throw new EncryptException('Could not encrypt the data.');\n        }\n\n        return base64_encode($json);\n    }\n","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/laravel/framework/blob/bd6b5437e6ad87bb49f9b426724f07a9f64e9683/src/Illuminate/Encryption/Encrypter.php#L96-L132","documentation":"Encrypter.encrypt() throws EncryptException('Could not encrypt the data.') when openssl_encrypt() returns false. OpenSSL returns false on internal failure — typically an unsupported algorithm in the linked OpenSSL build, an invalid IV length, or a key/algorithm mismatch that bypassed the constructor's supported() check. This is distinct from the JSON-encode failure at line 127.","triggerScenarios":"Calling encrypt($value) where the cipher string (e.g. 'aes-256-gcm') is not actually compiled into the host's OpenSSL — common on minimal/old PHP images or when the cipher was set to a variant OpenSSL doesn't expose. Also possible after tampering with $this->cipher or passing an IV shorter than openssl_cipher_iv_length() expects.","commonSituations":"PHP built against a stripped OpenSSL without GCM support; Alpine/slim Docker images missing openssl CA/algos; switching cipher to aes-256-gcm on a host whose OpenSSL lacks AEAD; custom Encrypter subclasses overriding the cipher; openssl extension disabled.","solutions":["Verify the cipher is available: in_array('aes-256-gcm', openssl_get_cipher_methods(true)).","Install/enable the full openssl extension and a complete OpenSSL build (e.g. swap alpine for debian image, or apk add openssl).","Fall back to a CBC cipher that your OpenSSL supports and regenerate APP_KEY at the matching length.","Confirm PHP's openssl extension is loaded: php -m | grep openssl."],"exampleFix":"// before — cipher not available in OpenSSL\n// config/app.php 'cipher' => 'aes-256-gcm'\n\n// diagnostic\nvar_dump(in_array(strtolower('aes-256-gcm'), openssl_get_cipher_methods(true)));\n// false => OpenSSL lacks GCM\n\n// after — pick a supported cipher and matching key length\n// config/app.php 'cipher' => 'aes-256-cbc'\n// regenerate key: php artisan key:generate","handlingStrategy":"validation","validationCode":"$cipher = strtolower(config('app.cipher'));\nif (! in_array($cipher, openssl_get_cipher_methods(true), true)) {\n    throw new \\RuntimeException(\"OpenSSL lacks cipher {$cipher}; install/enable full openssl\");\n}","typeGuard":"function cipherAvailable(string $cipher): bool\n{\n    return in_array(strtolower($cipher), openssl_get_cipher_methods(true), true);\n}","tryCatchPattern":"try {\n    $encrypted = encrypt($value);\n} catch (\\Illuminate\\Contracts\\Encryption\\EncryptException $e) {\n    // likely OpenSSL lacks the cipher; check openssl_get_cipher_methods()\n    throw $e;\n}","preventionTips":["Verify openssl_get_cipher_methods() includes your cipher before deploy.","Use full OpenSSL builds in Docker images (avoid stripped alpine openssl).","Confirm `php -m` lists openssl on every environment."],"tags":["encryption","openssl","php-runtime","configuration"],"analyzedSha":"bd6b5437e6ad87bb49f9b426724f07a9f64e9683","analyzedAt":"2026-08-06T00:28:32.783Z","schemaVersion":2}