# Laravel: Illuminate\Contracts\Encryption\DecryptException: The payload is invalid. / The MAC is invalid.

**Code:** `DecryptException: The payload is invalid / The MAC is invalid` · **Category:** Laravel · **Seen on:** Laravel, PHP

Laravel couldn't decrypt a cookie, session or encrypted value — the `APP_KEY` changed or the data was corrupted.

## Meaning

Cookies and encrypted data are signed with `APP_KEY`. After key regeneration, different keys across servers, or a changed `.env`/config cache, old cookies fail. Users just need new sessions (clear cookies); for load-balanced setups use the same key everywhere. Stored encrypted DB values become unreadable if the key is lost.

## Common causes

- APP_KEY changed or regenerated
- Different APP_KEY across servers
- Config cached with an old key
- Corrupted or truncated cookie
- Encrypted data written under another key

## Quick fix

1. Use one persistent `APP_KEY` on all servers
2. Clear the browser cookies / sessions
3. `php artisan config:clear`

## Detailed fix by platform

### Laravel

1. Rotate keys safely with `APP_PREVIOUS_KEYS` (Laravel 11+) to keep decrypting old data

## How to diagnose

1. **Key** — Same on all servers?
2. **Change** — Recently regenerated?
3. **Cache** — Config cleared?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/laravel/decrypt-exception-payload-invalid)