- What is codelieutenant/laravel-crypto used for?
- It is a Laravel wrapper for common hashing and encryption algorithms used in web applications. It provides secure encryption and decryption helpers and integrates as a drop-in extension of Laravel's Encrypter through the service container and Eloquent casts or traits. Version 3 adds per-user encryption, which is aimed at multi-tenant or data-isolation use cases.
- How do I install codelieutenant/laravel-crypto in a Laravel app?
- Install it with Composer, publish its configuration, and swap your Eloquent casts or traits to use the package. The mechanical integration is low effort, but the real work is key management rather than code. Check composer.json for the exact PHP and Laravel constraints before installing, especially if you are evaluating v3 alpha.
- Which Laravel and PHP versions does laravel-crypto support?
- The package is described as assuming Laravel 9–11 and PHP 8.1+, consistent with v2. Alpha releases often bump minimum PHP or Laravel constraints, so confirm the exact values in composer.json before committing. Do not rely on the v2 matrix for v3 without checking.
- How does per-user encryption work in laravel-crypto v3?
- It moves from one app-wide key to a key per user or tenant, which introduces a key-derivation and key-lookup layer. The application must own that layer and decide how per-user key material is stored, derived, rotated, and recovered. That design work is yours, not something the package fully solves.
- Can I use laravel-crypto v3.0.0-alpha1 in production?
- No. v3.0.0-alpha1 is explicitly pre-stable, and the public API, config schema, and on-disk ciphertext format may change before GA. Do not ship an alpha of a security-critical package to production. If you spike it, pin an exact alpha tag rather than a floating constraint.
- How do I migrate from laravel-crypto v2 to v3?
- Treat it as a data migration, not a dependency bump. Inventory every encrypted column, classify ownership by tenant or user, add a v3 read-only shadow path, and backfill by decrypting with the v2 app key and re-encrypting with the resolved per-user key into a new column or table. Cut reads over with the old columns retained for rollback, and only drop v2 ciphertext after a clean backfill. The release notes do not describe this path, so read PR #41 and the diff.
- Where is per-user key material stored and can I use a KMS?
- The package introduces key derivation and lookup, but the application owns where key material lives. Common options include a database, a KMS, or a master secret plus a user salt. KMS or HSM backend support is not confirmed in the provided context, so ask the maintainer before designing around it.
- What happens if a per-user encryption key is lost?
- With per-user keys, losing or corrupting key material means losing that user's data, and there is no app-wide recovery path like v2's single key. This is a sharper failure mode than the previous model. You need an escrow, backup, or recovery design before production, because the package does not remove that operational risk.
- Does laravel-crypto support key rotation without downtime?
- The key-rotation story for an individual user is still an open question in the provided assessment and is not described in the sparse release notes. A safe design must handle rotation without downtime and without making ciphertext unreadable. Ask the maintainer for the intended rotation flow before relying on it.
- Is codelieutenant/laravel-crypto actively maintained and what are the alternatives?
- The assessment flags a single-maintainer signal, one contributor on the release PR, and bus-factor risk for a security-critical dependency. There is also no security review, CVE history, or disclosure policy described in context, so ask for those. An alternative is Laravel's native encrypted cast plus your own key resolver, wrapped behind a thin encryption interface so you can swap implementations.