Weave Code
Crypto For Laravel Laravel Package
roundly-consulting/crypto-for-laravel
Crypto for Laravel adds a clean, framework-native layer for common cryptography tasks—encryption, decryption, hashing, and secure random/key generation—with config-driven setup, facades, and helpers so you can keep sensitive data safe without wiring low-level PHP crypto code yourself.
Crypto for Laravel provides a clean, Laravel-native wrapper around common cryptographic operations, making it easy to add secure encryption, hashing, and key handling to your applications. It integrates with Laravel’s configuration and service container, so keys and cipher settings stay consistent across environments.
- Simple facade/API for encrypting and decrypting values
- Config-driven keys and cipher selection
- Hashing and verification helpers for sensitive data
- Framework integration with service provider, facade, and publishable config
- Test-friendly design for predictable cryptographic workflows
Frequently asked questions about Crypto For Laravel
- How do I install roundly-consulting/crypto-for-laravel?
- Install it with Composer using composer require roundly-consulting/crypto-for-laravel. Laravel's package auto-discovery registers the service provider, so no manual provider entry is needed in most applications. Because the package is designed to be zero-config, you can start calling the primitives immediately after the Composer install completes.
- Which Laravel and PHP versions does this package support?
- The authoritative answer is in the require block of the package's composer.json on Packagist and in the README. Check those constraints before upgrading Laravel or PHP, since cryptographic primitives can depend on newer language features. Pin the package version in composer.json and run your test suite against your target framework version.
- Do I need to publish a config file to use this package?
- No. The package is intentionally zero-config, so JWS, TOTP/HOTP, HMAC, token generation, and codecs work out of the box with sensible defaults. You only supply the inputs you need, such as a shared secret, a key, or a payload. If the README documents optional config for advanced cases, publish it only when you actually need to override defaults.
- How do I generate and verify TOTP codes for two-factor authentication in Laravel?
- Use the package's TOTP primitive with a per-user secret stored securely, then compare the submitted code against the current time step. The same family of primitives covers HOTP when you need counter-based codes, which is useful for hardware tokens or non-time-based flows. Always verify with a small clock-skew window, store secrets encrypted at rest, and rate-limit verification attempts to prevent brute force.
- Can this package verify WebAuthn signatures in my Laravel app?
- Yes. The package provides WebAuthn signature verification as one of its primitives, which is the cryptographic core of a passkey or security-key login flow. It verifies signatures, but you are still responsible for the surrounding ceremony logic: issuing and validating challenges, storing credential IDs and public keys, and tracking signature counters. Combine it with HTTPS-only endpoints and short challenge lifetimes.
- What JOSE and JWS features are included?
- The package covers JWS/JOSE signing and verification, giving you a native way to produce and validate compact tokens without pulling in an external JWT library. It is aimed at developers who want framework-friendly access to the underlying primitives rather than a full opinionated OAuth stack. Review the README for the exact algorithm list supported in your installed version, since algorithm availability matters for interoperability.
- Is this package audited and safe to use in production?
- The package is described as native and audited, which means it wraps well-reviewed cryptographic implementations rather than inventing new algorithms. That lowers risk, but production safety still depends on your usage: keep secrets out of version control, rotate keys, use constant-time comparisons, and never log sensitive material. Read the README and repository history for the audit scope and any noted limitations before shipping.
- How do I generate cryptographically secure random tokens with this package?
- Use the CSPRNG token primitive instead of rand, mt_rand, or uniqid for anything security-sensitive. It produces tokens suitable for API keys, password reset links, session identifiers, and one-time codes. Choose a token length appropriate to the threat model, store only a hash of long-lived tokens where possible, and set an expiry on anything emailed or sent to a user.
- What does 'à la carte' mean for this package?
- It means the primitives are exposed independently, so you can use TOTP without touching WebAuthn, or HMAC and codecs without adopting JOSE. There is no monolithic crypto service you must configure before using a single helper. That keeps your dependency surface and your mental overhead small when you only need one capability.
- How should I test code that relies on this package?
- Use deterministic inputs: fixed secrets and an injected or frozen clock for TOTP/HOTP, and known-answer test vectors for HMAC, JWS, and codecs. Because the primitives are stateless and zero-config, most tests can call them directly without booting extra infrastructure. For WebAuthn, generate or capture fixture assertions once and assert both the happy path and tampered-signature failures.
Weaver
How can I help you explore Laravel packages today?