tapanderasari/laravel-mysql-encrypt

Laravel Database encryption mysql side

v3.0.0 2026-03-18 05:22 UTC

Requires

• php: ^8.3
• illuminate/database: ^13.0
• illuminate/support: ^13.0

Requires (Dev)

• orchestra/testbench: ^11.0
• pestphp/pest: ^4.0
• pestphp/pest-plugin-laravel: ^3.0|^4.0

MIT

• Tapan Derasari

• php
• mysql
• encryption
• laravel
• pii
• tapanderasari

README

Laravel database encryption at database side using native AES_DECRYPT and AES_ENCRYPT functions. Automatically encrypt and decrypt fields in your Models.

Version Compatibility

Package Version	Laravel	PHP
3.x	13.x	^8.3
1.x	10–12	^8.0

Install

1. Composer

composer require tapanderasari/laravel-mysql-encrypt

2. Publish config (optional)

php artisan vendor:publish --provider="TapanDerasari\MysqlEncrypt\Providers\LaravelServiceProvider"

3. Set encryption key in .env file

APP_AESENCRYPT_KEY=yourencryptionkey

Update Models

<?php

namespace App;

use TapanDerasari\MysqlEncrypt\Traits\Encryptable;
use Illuminate\Database\Eloquent\Model;

class User extends Model
{
    use Encryptable; // <-- 1. Include trait

    public array $encryptable = [ // <-- 2. Include columns to be encrypted
        'email',
        'first_name',
        'last_name',
        'telephone',
    ];
}

Schema

Encrypted columns must use VARBINARY (or BINARY/BLOB) in MySQL, not VARCHAR.

Schema::create('users', function (Blueprint $table) {
    $table->bigIncrements('id');
    $table->string('password');
    $table->binary('first_name', 300);  // VARBINARY(300)
    $table->binary('last_name', 300);
    $table->binary('email', 300);
    $table->binary('telephone', 50);
    $table->rememberToken();
    $table->timestamps();
});

Validators

unique_encrypted

unique_encrypted:<table>,<field(optional)>,<ignore_id(optional)>

exists_encrypted

exists_encrypted:<table>,<field(optional)>

Scopes

A global scope DecryptSelectScope is automatically applied to models using the Encryptable trait. It rewrites SELECT queries to wrap encrypted columns with AES_DECRYPT().

The following local scopes are available:

Exact match

User::whereEncrypted('email', '[e-mail]')->first();
User::whereNotEncrypted('email', '[e-mail]')->get();

OR conditions

User::whereEncrypted('email', '[e-mail]')
    ->orWhereEncrypted('email', '[e-mail]')
    ->get();

User::whereNotEncrypted('email', '[e-mail]')
    ->orWhereNotEncrypted('email', '[e-mail]')
    ->get();

LIKE search

User::whereEncryptedLike('first_name', 'John')->get();
User::orWhereEncryptedLike('first_name', 'Jane')->get();

Ordering

User::orderByEncrypted('first_name', 'asc')->get();
User::orderByEncryptedSort('last_name', 'desc')->get();

Implementing encryption for existing data

For this you can create one command like

php artisan make:command EncryptionForExistingData

In this command you fetch existing table or model data without global scope DecryptSelectScope.

You can refer the example, clicking on below Example button:

License

The MIT License (MIT). Please see License File for more information.