Laravel - DecryptException: 'The MAC is invalid' - php

Question

In laravel for registration I'm using encrypt algorithm for password instead of inbuilt bcrypt function in Laravel because to get password and send it to mail when password is forgot.
But decrypt it is showing a error like
DecryptException The MAC is invalid in Encrypter.php (line 184)
This , when I run this code it is working on local but server itself it is not working below i have mentioned the code , can anyone please help
public function forgotpassword(Request $request)
{
$email=$request->email;
$selectemail = User::select('email','password','name')
->where('email',$email)
->first();
if($selectemail)
{
$password=decrypt($selectemail->password);
$data = array( 'email' => $selectemail->email,'password' => $password , 'name' => $selectemail->name);
Mail::send('email.resetpassword',$data,function($message) use ($email)
{
$message->to([$email])->subject('Forgot Password Letgo');
});
echo "Mail has sent successfully";
} else {
echo "This email is not yet registered";
}
}

Answer 1

The problem is you generated a new APP_KEY, then if you try to decrypt the old encrypted data it will show the DecryptException: The MAC is invalid.
If you want to decrypt the old data you need to restore your old APP_KEY.
After realizing that, now, adding a new problem there, if you stored new data with another APP_KEY or another encryption method you have a problem on the data because they are mixed on the table.
In case you don't know when do you started with the new encrypt method or differentiate the new encrypted entries, the fastest solution would be reset all the passwords with the new encrypt method.
You can learn more about how Laravel encryption works on the official Laravel docs.

Answer 2

I copied the APP_KEY from the environment it was working dev to the production and the issue was solved. you may want to try it.

Answer 3

In case none of the above helped you, as it was in my case, well, some people mention clearing the cookies, sadly that is ambiguous to say the least.
I tried everything from the above, clear cache in laravel and the browser, hard reload and all..With no success!
SOLUTION: just CLOSE the browser entirely, and reopen it. In my case, I was using both Chrome and Opera, and they were both messing up. I had to close them BOTH, then reopen them for the MAC problem to disappear.

Answer 4

To avoid this, use a custom key instead. The default key is APP_KEY, but you can provide one so your decrypt is not linked with new or old APP_KEY.
I use the following code to resolve it, and it worked in different APP_KEYs.
function customCrypt($vWord){
$customKey = "blabla_key_with_correct_length";
$newEncrypter = new \Illuminate\Encryption\Encrypter( $customKey, Config::get( 'app.cipher' ) );
return $newEncrypter->encrypt( $vWord );
}
function customDecrypt($vWord){
$customKey = "blabla_key_with_correct_length";
$newEncrypter = new \Illuminate\Encryption\Encrypter( $customKey, Config::get( 'app.cipher' ) );
return $newEncrypter->decrypt( $vWord );
}
Important for key length : if $cipher == 'AES-128-CBC' use $length === 16, if $cipher == 'AES-256-CBC' use $length === 32). Check in config/app.cipher which cipher your app uses.

Answer 5

If you run multiple project and passes one encryption key to another project, Just make sure you have made same APP_KEY to your both project.

Answer 6

App key matters in encryption and decryption. I was having 2 sub
domains with different projects in which I was encrypting value on sub
domain and 1 and trying to decrypt on sub domain 2. Issue was resolved
when both projects were having same appkey. Note: No projects should
have same appkey!!!
If you have imported DB form one environment to another, most likely you will face this error. Its recommended to have same APP_KEY as data source application in order to fix bug.

Answer 7

If you have run 2 different Laravel applications locally in the same browser, cookies can be saved in your browser. Please clear the cache and cookies before loading the 2n app.