Weave Code
Sodium Bundle Laravel Package
geekcell/sodium-bundle
GeekCell Sodium Bundle integrates PHP's Sodium extension with Symfony, providing configurable services for authenticated encryption, decryption, password hashing, and secure random bytes. It simplifies using libsodium's modern cryptography in your applications.
A Symfony bundle to interact with PHP's Sodium extension for encryption and decryption.
Frequently asked questions about Sodium Bundle
- What does geekcell/sodium-bundle actually do?
- It is a Symfony bundle that wraps PHP's libsodium extension in autowired services so you can encrypt and decrypt payloads without writing raw sodium_* calls. It provides authenticated secret-key encryption via crypto_secretbox, automatic nonce generation, ciphertext encoding helpers, and secret-key generation and validation utilities. Everything is wired through Symfony's dependency injection container, so keys come from bundle configuration instead of your own code.
- Is geekcell/sodium-bundle a Laravel package or a Symfony bundle?
- It is a Symfony bundle, not a Laravel package. Laravel consumes individual Symfony components such as HttpFoundation and Console, but it does not implement the bundle contract or run Kernel::registerBundles(). A bundle is a distribution and wiring unit for Symfony's kernel, so nothing here gets registered in a Laravel application.
- Can I install geekcell/sodium-bundle in a Laravel application?
- Composer will install it, but the service definitions and services.yaml are never read, so you end up with an uninstantiated definition rather than a working encryption service. To get value you would have to fork the bundle and re-express its services as a Laravel ServiceProvider, which inherits an unknown amount of Symfony-specific plumbing. It is usually faster to call the sodium functions directly behind a small internal interface.
- Which libsodium primitives does the bundle wrap?
- According to the package description it wraps Sodium's authenticated secret-key cryptography, primarily crypto_secretbox, with automatic nonce generation and safe ciphertext encoding and decoding. It does not document support for public-key box, box_seal, sign or aead modes, so confirm with the source before assuming those are covered. The security properties and key-management requirements differ materially per primitive.
- Is geekcell/sodium-bundle maintained and safe for production?
- No. The repository is archived and has roughly one star with zero dependents. For a general utility that is merely unfortunate; for an encryption wrapper it is disqualifying on its own terms. An archived crypto abstraction means no CVE response path, no nonce-handling corrections, and no upstream to escalate to during an incident.
- Does Laravel already include encryption that covers this use case?
- Yes. Illuminate\Encryption\Encrypter provides AES-256-GCM and AES-256-CTR authenticated encryption through OpenSSL as a first-party, framework-integrated solution with key rotation support. The ext-sodium extension itself has shipped bundled with PHP since 7.2 and is enabled by default in most distributions, so the underlying capability is already on the platform. Adding a second, parallel crypto path needs a clear business justification.
- What PHP version and extensions does geekcell/sodium-bundle require?
- The bundle requires PHP 7.2 or newer and the ext-sodium extension, which is present in most PHP builds by default. That floor is well below what current Laravel versions require, so PHP support is not the blocker here. The missing Laravel integration and the archived status are the real issues.
- How do I use libsodium in Laravel without this bundle?
- Wrap the primitive you need behind a single internal EncryptionService interface, for example sodium_crypto_secretbox with a randomly generated 24-byte nonce stored alongside the ciphertext. That is roughly 50 to 150 lines of code, has no abandoned dependency, and gives you full control over nonce handling and key access. Keep key retrieval in one config or KMS adapter so rotation stays a one-place change.
- What are maintained alternatives to geekcell/sodium-bundle?
- Laravel's native Encrypter is the first-party option for most applications. paragonie/sodium_compat provides a polyfill where ext-sodium is unavailable, halite offers a higher-level libsodium API, and calling sodium_crypto_secretbox or sodium_crypto_box_seal directly covers the rest. Pick based on whether Sodium specifically is mandated or modern authenticated encryption is sufficient.
- How should I handle nonces, key rotation and testing for Sodium encryption?
- Generate a fresh random nonce for every encryption operation, store it alongside the ciphertext, and never reuse one with the same key; a well-designed service should make reuse structurally impossible rather than leaving it to the caller. Version your ciphertext so older keys can still decrypt existing data during rotation. Backfill round-trip tests that encrypt and decrypt known payloads and assert that tampered ciphertext fails authentication before adopting any crypto dependency.
Weaver
How can I help you explore Laravel packages today?