DecryptException: The payload is invalid / The MAC is invalid Laravel Origin: Application & API OSI layer 7 · Application Last updated 4 Nov 2026

Laravel: Illuminate\Contracts\Encryption\DecryptException: The payload is invalid. / The MAC is invalid.

Laravel couldn't decrypt a cookie, session or encrypted value — the APP_KEY changed or the data was corrupted.

Exact message you may see DecryptException: The payload is invalid.The MAC is invalid.Illuminate\Contracts\Encryption\DecryptException The MAC is invalidThe payload is invalid LaravelIlluminate\Encryption\Encrypter DecryptException
Explore the map of this error Full error map →
Seen on: Laravel PHP

Meaning

Cookies and encrypted data are signed with APP_KEY. After key regeneration, different keys across servers, or a changed .env/config cache, old cookies fail. Users just need new sessions (clear cookies); for load-balanced setups use the same key everywhere. Stored encrypted DB values become unreadable if the key is lost.

Common causes

  • APP_KEY changed or regenerated
  • Different APP_KEY across servers
  • Config cached with an old key
  • Corrupted or truncated cookie
  • Encrypted data written under another key

⚡ Quick fix

  1. Use one persistent APP_KEY on all servers
  2. Clear the browser cookies / sessions
  3. php artisan config:clear

Detailed fix by platform

Laravel

  1. Rotate keys safely with APP_PREVIOUS_KEYS (Laravel 11+) to keep decrypting old data

How to diagnose

  1. Key — Same on all servers?
  2. Change — Recently regenerated?
  3. Cache — Config cleared?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

403 This action is unauthorized — Laravel: Illuminate\Auth\Access\AuthorizationException: This action is unauthorized. (Laravel)403 This action is un…ActiveSupport::MessageEncryptor::InvalidMessage — Rails: ActiveSupport::MessageEncryptor::InvalidMessage (credentials.yml.enc can't be decrypted — wrong master.key) (Ruby / Rails)ActiveSupport::Messag…Attempt to read property "x" on null — Laravel/PHP 8: ErrorException: Attempt to read property "name" on null (Laravel)Attempt to read prope…Command "x" is not defined — Laravel: Symfony\Component\Console\Exception\CommandNotFoundException: Command "make:livewire" is not defined. Did you mean one of these? (Laravel)Command "x" is not de…Laravel: Allowed memory size exhausted (request) — Laravel/PHP: Allowed memory size of 134217728 bytes exhausted (tried to allocate 20480 bytes) in vendor/laravel/framework (Laravel)Laravel: Allowed memo…No application encryption key — Laravel: No application encryption key has been specified. (PHP)No application encryp…Session store not set on request — Laravel: RuntimeException: Session store not set on request (Laravel)Session store not set…Token has expired (tymon/jwt-auth) — Laravel JWT: Tymon\JWTAuth\Exceptions\TokenExpiredException: Token has expired / The token could not be parsed from the request (Laravel)Token has expired (ty…DecryptEx…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.