{"id":"b66acdda3ebbd951","repo":"laravel/framework","slug":"could-not-decrypt-the-data","errorCode":null,"errorMessage":"Could not decrypt the data.","messagePattern":"Could not decrypt the data\\.","errorType":"exception","errorClass":"DecryptException","httpStatus":null,"severity":"error","filePath":"src/Illuminate/Encryption/Encrypter.php","lineNumber":201,"sourceCode":"            );\n\n            if ($decrypted !== false) {\n                break;\n            }\n        }\n\n        if ($this->shouldValidateMac() && $validKey === null) {\n            throw new DecryptException('The MAC is invalid.');\n        }\n\n        if ($this->shouldValidateMac()) {\n            $decrypted = \\openssl_decrypt(\n                $payload['value'], strtolower($this->cipher), $validKey, 0, $iv, $tag ?? ''\n            );\n        }\n\n        if (($decrypted ?? false) === false) {\n            throw new DecryptException('Could not decrypt the data.');\n        }\n\n        return $unserialize ? unserialize($decrypted) : $decrypted;\n    }\n\n    /**\n     * Decrypt the given string without unserialization.\n     *\n     * @param  string  $payload\n     * @return string\n     *\n     * @throws \\Illuminate\\Contracts\\Encryption\\DecryptException\n     */\n    public function decryptString($payload)\n    {\n        return $this->decrypt($payload, false);\n    }\n","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/laravel/framework/blob/bd6b5437e6ad87bb49f9b426724f07a9f64e9683/src/Illuminate/Encryption/Encrypter.php#L183-L219","documentation":"decrypt() throws DecryptException('Could not decrypt the data.') when openssl_decrypt() ultimately returns false — i.e. neither the current nor any previous key successfully decrypts the ciphertext. Also thrown by ensureTagIsValid() when an AEAD tag is the wrong length (16 bytes required). Distinguish from [256]: this fires when the MAC (if checked) was OK but decryption still failed, or for AEAD ciphers where the tag/auth failed.","triggerScenarios":"Corrupted ciphertext/IV/tag in the payload; truncated base64; payload encrypted with an algorithm different from the current cipher; AEAD tag missing or wrong length; an encrypted value passed through a transport that mangled bytes (URL encoding, charset conversion).","commonSituations":"Cookies mangled by proxies/CDNs; encrypted query params URL-decoded incorrectly; switching from CBC to GCM (or vice versa) without re-encrypting; truncated database columns holding encrypted values; copy-paste truncation of long base64.","solutions":["Verify the payload is transmitted byte-exact: use rawurlencode/rawurldecode for URLs, store as BLOB/VARBINARY not as lossy VARCHAR without a proper collation.","Confirm cipher hasn't changed since the value was encrypted; re-encrypt existing data after cipher migrations.","For AEAD, ensure the tag field is present and 16 bytes after base64_decode; ensureTagIsValid enforces this.","Log the payload length and base64-decodability to isolate corruption from key mismatch."],"exampleFix":"// before — encrypted value stored in a charset-lossy column\n// migrations: $table->string('token');  // collation truncates bytes\n\n// after — store as binary\n$table->binary('token');\n// and round-trip via the encrypter untouched:\n$stored = encrypt($value);\n$back = decrypt($stored);","handlingStrategy":"try-catch","validationCode":"// Ensure byte-exact transport and storage\n$raw = $request->input('token');\nif (is_string($raw) && \\Illuminate\\Encryption\\Encrypter::appearsEncrypted($raw)) {\n    return decrypt($raw);\n}","typeGuard":null,"tryCatchPattern":"try {\n    $value = decrypt($payload);\n} catch (\\Illuminate\\Contracts\\Encryption\\DecryptException $e) {\n    // log length/base64 validity; treat as corrupted/untrusted\n    logger()->warning('decrypt failed', ['len' => strlen($payload ?? '')]);\n    $value = null;\n}","preventionTips":["Store encrypted values in binary-safe columns (BLOB/VARBINARY).","URL-transport encrypted values with rawurlencode/rawurldecode.","Do not change cipher without re-encrypting; preserve base64 padding in transit."],"tags":["encryption","decryption","data-corruption","openssl"],"analyzedSha":"bd6b5437e6ad87bb49f9b426724f07a9f64e9683","analyzedAt":"2026-08-06T00:28:32.783Z","schemaVersion":2}