Laravel - DecryptException: 'The MAC is invalid'
Stefan Izdrail
Founder & Senior Architect · 2026-06-29
Title: Common Issues and Solutions for DecryptException in Laravel Applications
Introduction
Laravel is an open-source PHP framework that simplifies the process of building web applications by offering numerous built-in features, including authentication and encryption. While encryption ensures secure communication between users, it can sometimes lead to errors when decrypting data. In this comprehensive blog post, we'll discuss one such error, DecryptException: 'The MAC is invalid', and provide troubleshooting methods, along with possible code solutions applicable to Laravel applications.
What Causes the Error "DecryptException The MAC is Invalid"?
Whenever you use encryption in Laravel to store passwords, you'll need to decrypt them when necessary, such as during the mailing of reset links or any other scenario where secure communication between users is essential. However, sometimes the decryption process encounters issues, and one common error encountered is the "DecryptException The MAC is invalid" exception. This could be due to either an incorrect encryption key, mismatch in the salt used during encryption, or even inconsistencies in the provided data.
Troubleshooting and Solutions
To resolve this error, you should first identify if it's a configuration error or an issue with the data itself. Here are some steps to follow:
1. Ensure the encryption key and salt values are consistent between applications.
- Laravel encrypts passwords using a unique combination of keys and salts for added security, generated when you install the framework. Make sure your application is using the correct keys/salts from the same installation or that they match between both the local and production environments.
2. Check encryption methods used in your code.
- Laravel offers two different encryption algorithms: AES-128-CBC cipher with a SHA256 MAC (Message Authentication Code) and AES-256-CBC cipher with a SHA384 MAC. If you're using one algorithm in your code but the other one during decryption, it will result in this error.
3. Ensure correct data types for password decryption.
- Laravel encrypts and decrypts strings only, so make sure your plain text matches this requirement. For instance, if you're storing an array as a password, you should encode it as a string using PHP's json_encode function before encryption.
4. Check your code for syntax or spelling errors.
- A single typo in the code can result in this error. Make sure your code is error-free and adheres to Laravel coding conventions.
5. Use laravel-debugbar/barrage extension.
- To gain more insights on your application's errors, including DecryptException issues, install the Laravel Debugbar bundle (laravel-debugbar/barrage) in your project. This will help to pinpoint the faulty line of code causing the error.
Code Refactoring Suggestions:
To minimize the risk of encountering this error, you can use Laravel's built-in cryptographic functions instead of encryption. For example, replace the decryption code in your forgotten password mailer with:
$password = bcrypt($selectemail->password);
$data = array( 'email' => $selectemail->email, 'password' => $password , 'name' => $selectemail->name);