Weave Code
Shh Laravel Package
bentools/shh
Shh! is a lightweight PHP library for handling secrets: generate RSA key pairs, change private key passphrases, encrypt/decrypt payloads, and store encrypted secrets safely so only holders of the private key can decrypt.
A small package to handle secrets.
Frequently asked questions about Shh
- How do I integrate Shh! with Laravel’s existing encryption system?
- Shh! is standalone but can complement Laravel’s Encrypter. Use it for asymmetric encryption (RSA) where needed, while keeping AES for symmetric cases. For hybrid setups, store encrypted secrets in `storage/app/secrets/` or a database table, then decrypt using Shh! when accessed. Example: Encrypt API tokens with Shh! before storing in the database.
- What Laravel versions does Shh! support?
- Shh! requires PHP 7.4+ and works seamlessly with Laravel 8, 9, and 10. It has no Laravel-specific dependencies, so it won’t conflict with newer Laravel features. Test thoroughly if using Laravel 10+ with its Vault integration, as Shh! isn’t officially tied to it.
- Can I use Shh! to rotate secrets without breaking existing encrypted data?
- Yes. Shh! supports generating new RSA key pairs while keeping old private keys for backward compatibility. When rotating secrets, decrypt old payloads with the old key, re-encrypt with the new key, and store both keys temporarily. This avoids downtime during transitions.
- How do I securely store private keys in Laravel?
- Private keys must never be committed to version control. Store them in Laravel’s encrypted storage (e.g., `storage/app/keys/private_key.pem` with strict filesystem permissions) or use a secrets manager like AWS KMS, HashiCorp Vault, or Laravel’s Vault (if on Laravel 10+). Avoid hardcoding or logging keys.
- Is Shh! faster than Laravel’s built-in Encrypter for large payloads?
- No. Shh! uses RSA-OAEP (asymmetric) which is slower than Laravel’s AES-256-CBC (symmetric). For performance-critical applications, use Shh! only for key exchange or hybrid schemes (e.g., encrypt with AES, wrap the key with RSA). Benchmark with `microtime()` to compare throughput.
- How do I encrypt secrets for storage in a database using Shh!?
- Encrypt secrets with Shh! before inserting them into the database. Example: `$encrypted = $shh->encrypt($secret); DB::table('secrets')->insert(['value' => $encrypted]);`. To decrypt later, retrieve the encrypted value and use `$shh->decrypt()`. Store public keys in config/cache for reuse.
- What happens if I lose the private key?
- Losing the private key means **permanent data loss** for all encrypted secrets. There’s no recovery mechanism. Mitigate this by backing up keys securely (e.g., encrypted USB drive or secrets manager) and documenting key rotation procedures. Use Laravel’s `config/shh.php` to centralize key paths.
- Can I use Shh! to encrypt Laravel’s `.env` file secrets?
- No, Shh! isn’t designed for `.env` files. Laravel’s `.env` is decrypted at runtime by PHP, so encrypting it would break the application. Instead, use Shh! to encrypt sensitive values (e.g., API keys) stored in a database or config file, then decrypt them dynamically in your code.
- Are there alternatives to Shh! for Laravel secret management?
- Yes. For symmetric encryption, Laravel’s built-in `Encrypter` (AES) is sufficient. For asymmetric needs, consider `phpseclib` or `paragonie/halite`. For managed secrets, use Laravel Vault (L10+), AWS Secrets Manager, or HashiCorp Vault. Shh! stands out for its simplicity in RSA key management and hybrid encryption patterns.
- How do I test Shh! in a Laravel application before production?
- Start by encrypting/decrypting test data in a `php artisan tinker` session. Write unit tests using Laravel’s `TestCase` to verify encryption/decryption cycles. Mock the `Shh` class to test edge cases (e.g., invalid passphrases, corrupted payloads). Use Laravel’s `fresh()` to test key rotation without affecting production.
Weaver
How can I help you explore Laravel packages today?