Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

mehany's avatar
Level 13

Why this error appears? The cipher and / or key length are invalid

I am sure you have seen people posting this error before and I normally do php artisan key:generate to generate a valid key for me. But here is the odd part, during development ( and this happens often though ) i run into this error "No supported encrypter found. The cipher and / or key length are invalid" which I believe should not appear without truly committing the error. Can someone explain? Does the key becomes not readable by the application at a certain point during its check then it fails and throws the error? if so why?

0 likes
9 replies
Mariam's avatar

In config\app.php set

'cipher' => 'AES-256-CBC'
1 like
mehany's avatar
Level 13

I do have that.

'key' => env('APP_KEY'),

'cipher' => 'AES-256-CBC',

and .env

 APP_ENV=local
APP_DEBUG=true
APP_KEY=S043rl4v4ABY6PvkTejMejtsLIRipr2d
1 like
mehany's avatar
Level 13

Maybe the way I am defining the route is contributing to the appearance of this error? For example, the below line will make this error appear more often for some reason

Route::get('/landing', function () { 
    return  (\Auth::guest())? view('guest.landing')   :   Redirect::to('/admin');

});

Mariam's avatar

we have discussed about it here the solution was just reinstalling homestead

mehany's avatar
Level 13

@Mariam yes, absolutely ( middleware for auth check ), this was a quick example which does generates the above error more often. Anyways, thank you for making me less paranoid, at least now I can blame Homestead.

1 like
Jaytee's avatar

Run the following in the Terminal:

php artisan key:generate

That should fix it.

OP: Sorry didn't read the first line properly. If it were the route, you can just add middleware to say it's for 'Authenticated Users only'

2 likes
mehany's avatar
Level 13

@DPJack this is not the issue. Digging into the source code, I found laravel's EncryptionServiceProvider is the one that makes the check for the Cipher length. I think the issue seem to be that the .env file is not readable during that check and that throws the a RuntimeException.

public function register()
{
    $this->app->singleton('encrypter', function ($app) {
        $config = $app->make('config')->get('app');

        $key = $config['key'];  // this piece of code is just trying to read the config file and I think it does not process the  'key' => env('APP_KEY')

        $cipher = $config['cipher']; // same here

        if (Encrypter::supported($key, $cipher)) {
            return new Encrypter($key, $cipher);
        } elseif (McryptEncrypter::supported($key, $cipher)) {
            return new McryptEncrypter($key, $cipher);
        } else {
            throw new RuntimeException('No supported encrypter found. The cipher and / or key length are invalid.');
        }
    });
}

//  Encrypter supported method
public static function supported($key, $cipher)
{
    $length = mb_strlen($key, '8bit');

    return ($cipher === 'AES-128-CBC' && $length === 16) || ($cipher === 'AES-256-CBC' && $length === 32);
}

//  McryptEncrypter supported method
public static function supported($key, $cipher)
{
    return defined('MCRYPT_RIJNDAEL_128') &&
            ($cipher === MCRYPT_RIJNDAEL_128 || $cipher === MCRYPT_RIJNDAEL_256);
}

In the config.php file I have 'key' => env('APP_KEY'), which is how I am getting to assume that the .env file becomes not readable for some reason. This also seem to happen not only in Homestead, but also in any Homestead like environment which is not good!

If Laravel supports the usage of .environment files, could it try { }catch(e){ } this check and maybe try env('APP_KEY') if $config['key'] fails?

mehany's avatar
Level 13

BTW, although this error gets thrown, it usually goes away once the page is refreshed.

Please or to participate in this conversation.