README

Encrypt Laravel source code and safely distribute applications without exposing PHP source files. Converts your Laravel application's PHP files into encrypted code that is decrypted only at runtime, allowing you to distribute Laravel applications while protecting your intellectual property.

Features

Encrypt controllers, models, services, and routes
Bundle encrypted code into a single runtime file
Runtime decryption via custom autoloader
Automatic Composer and npm build handling
Cross-platform (Windows, Linux, macOS)
Laravel 7.x through 13.x support
Optimized distribution builds
No external PHP extensions required

Quick Installation

composer require dev-reymark/laravel-source-encryptor
php artisan source:install

The source:install command will automatically publish the configuration file and securely generate and inject a SOURCE_ENCRYPTION_KEY into your .env file.

Usage

Build Production Distribution

php artisan source:build

The command will:

Installs Composer dependencies (--no-dev)
Installs npm dependencies if needed
Builds frontend assets (Vite / React / Vue)
Encrypts Laravel source files
Bundles encrypted code into a runtime file
Removes the original app/ directory
Generates encrypted route loaders
Create a clean distribution folder at dist/

Distribution Structure

dist/
 ├ artisan
 ├ bootstrap/
 │   └ cache/
 │       ├ config.enc
 │       └ source.enc
 ├ composer.json
 ├ composer.lock
 ├ database/
 ├ public/
 ├ resources/
 ├ routes/
 ├ storage/
 └ vendor/

The original app/ directory is removed. All encrypted source code is stored inside bootstrap/cache/source.enc.

Build Options

Skip frontend build:

php artisan source:build --no-frontend

By default, the build command will automatically attempt to run npm install and npm run build if it detects frontend assets. Use the --no-frontend flag to skip this process entirely. This is highly recommended for API-only applications or if you compile your frontend assets separately.

Skip composer install:

php artisan source:build --skip-composer

By default, the build command automatically runs composer install --no-dev inside the new dist/ directory. Use the --skip-composer flag to skip this step if you are running the build in a CI/CD pipeline or Docker environment where you prefer to handle Composer installation manually to utilize caching and speed up build times.

Configuration

You can customize the encryption behavior by modifying the config/source-encryptor.php file.

Excluding Directories from Encryption

If you have specific directories (or files) that you want to exclude from the encryption process (for example, if they need to be readable by third-party packages or contain specific assets), you can add them to the exclude array:

    'exclude' => [
        // Do not remove 'bootstrap' or 'storage' — Laravel requires these to remain as physical, unencrypted files.
        'bootstrap',
        'storage',
        // Add your own custom directories or files to exclude here:
        'app/Http/Controllers/Public',
    ],

Any files inside these excluded paths will be copied over to the dist directory exactly as they are, without being encrypted.

Running the Encrypted Application

cd dist
php artisan serve

Laravel automatically loads encrypted classes through the runtime loader.

How It Works

PHP files are compressed and encrypted using AES-256-CBC
Encrypted code is bundled into bootstrap/cache/source.enc
During runtime: Autoload request → EncryptedAutoloader → SourceLoader decrypts → PHP executes
Decrypted source never persists on disk

Frontend Support

The build system automatically detects frontend environments:

Environment	Behavior
API-only Laravel	Skips frontend build
Laravel + Blade	Skips if no build script
Vue Starter Kit	Runs `npm install` + `npm run build`
React Starter Kit	Runs `npm install` + `npm run build`
Vite Projects	Fully supported

Requirements

PHP 7.2.5+
Laravel 7.x - 13.x
OpenSSL extension enabled
Composer

Security Notes

Keep your SOURCE_ENCRYPTION_KEY private
Never commit .env to version control
Only distribute the dist/ directory

License

MIT License

Author

Rey Mark Tapar

Website | GitHub

dev-reymark / laravel-source-encryptor

Maintainers

Package info

Statistics

Security