The Magento encryption key is the secret value in app/etc/env.php under crypt.key. Adobe Commerce and Magento Open Source use it to protect passwords and other sensitive data. Keep the file out of source control, preserve the key in controlled backups, and use the CLI rotation workflow on current releases. Changing the key invalidates customer and administrator sessions, so treat rotation as a planned maintenance operation rather than a routine configuration edit.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the Magento encryption key does
During installation, Magento creates an encryption key automatically or lets the installer enter a supplied value. The resulting secret is used by cryptographic functions throughout the application. It is not an API token, a customer password, or a value intended for routine editing in the Admin panel.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Adobe describes the purpose directly: Adobe Commerce and Magento Open Source use an encryption key to protect passwords and other sensitive data. Data that must later be recovered in its original form is encrypted with the industry-standard ChaCha20-Poly1305 algorithm and a 256-bit key. Values that only need verification, not decryption, use SHA-256 hashing instead. A hash cannot be turned back into the original value; encrypted data can be decrypted only when the correct key is available.
Where Magento stores the key
The operational location is the Magento application root followed by app/etc/env.php. Inside that PHP configuration file, the relevant structure is the crypt section and its key value:
#1 Best Overall
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
'crypt' => [
'key' => 'your-secret-value'
],The exact value on a real installation is different. Do not paste it into tickets, chat messages, screenshots, public repositories, or deployment logs. Magento reads this value as part of its environment configuration; changing, deleting, or replacing it without preparing the protected data can make existing encrypted values unreadable.
How to protect env.php
env.php contains more than the encryption key. It commonly includes database connection details, credentials, and other environment-specific secrets. Adobe’s sensitive-settings guidance says not to include this file in source control. That rule applies whether the repository is public, private, hosted internally, or mirrored to a third-party service.
- Exclude the file from Git and other source-control systems. Add the appropriate path to ignore rules before the first commit, and remove any accidentally committed copy from repository history as well as from the current branch.
- Restrict filesystem access. The web-server and deployment accounts should have only the permissions they need. Other users on the host should not be able to read the file.
- Use controlled secret storage for backups. A database backup without the matching key may contain encrypted fields that cannot be recovered. Store the key and backup-recovery instructions in a secret-management process with audited access.
- Keep deployment copies synchronized. Every production, staging, and disaster-recovery environment must use the key that belongs to the encrypted data it serves. A deployment that overwrites
env.phpwith an unrelated copy can break decryption even when the code and database are otherwise correct. - Record rotations securely. After a successful change, retain the new key in the approved recovery system. Do not put it in a deployment log or a plaintext runbook.
The key is required when restoring or migrating a store because it is what permits Magento to decrypt protected values. Test your recovery procedure without exposing the secret to people or systems that do not need it.
Which release should use which rotation method?
| Magento or Adobe Commerce release | Supported rotation approach | Operational note |
|---|---|---|
| Before 2.4.8 | The command-line workflow is available on releases that provide encryption:key:change; some older releases also exposed an Admin encryption-key screen. |
Check the command list on the exact installation before scheduling the change. Do not assume an Admin control exists on every maintenance release. |
| 2.4.8 and later | Use bin/magento encryption:key:change. |
The Admin encryption-key feature was removed in 2.4.8. The CLI workflow is the current method. |
Release compatibility is the first decision point. A procedure copied from an older article may send you to an Admin screen that no longer exists. Run the command-list check described below on the server where the change will occur.
Rank #2
- Elevates your security with the CJMCU 608 ATECC608A Module,a cryptographic key storage module featuring Random Number Generator for data protections.
- This encryption module with NISTP256 elliptical curves,ensures robusts cryptographic functions.
- Suitable for embeddeds systems engineers and data security experts.
- This module is a tool for professional dedicated to safeguarding sensitive information.
- The ATECC608A is perfectly for devices,financial systems,and industrial control applications.
Prepare for a key rotation
Rotation changes the secret used for cryptographic operations and has an immediate session impact. Schedule a maintenance window long enough to complete the command, flush caches, perform any required re-encryption, and verify the storefront and checkout. Tell support staff that customers and administrators will be asked to sign in again after the change.
- Confirm that you have approved access to the Magento application root and the account that runs Magento CLI commands.
- Verify that
app/etc/env.phpis writable by the deployment or application account that will perform the rotation. - Take a recovery backup according to your normal database and file-backup policy, and confirm where the current and new keys will be stored.
- Identify encrypted custom columns or extensions. Magento’s documented default re-encryptors do not automatically cover every third-party or custom field.
- Decide whether the installation is Adobe Commerce Cloud or self-managed/on-premises, because the cron and cache commands differ.
Rotate the key with the CLI
Run the following sequence from the Magento application root. The order prevents cron jobs and customer traffic from writing data while the secret changes.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Confirm write access. Check that the process performing the operation can write
app/etc/env.php. Correct ownership or permissions through your deployment process if it cannot. - Enable maintenance mode. Run
bin/magento maintenance:enable. Confirm that the storefront shows the maintenance response before continuing. - Stop scheduled jobs. On Adobe Commerce Cloud, run
./vendor/bin/ece-tools cron:disable. On an on-premises installation, pause the Magento crontab using the host’s approved service or scheduling procedure. - Check command availability. Run
bin/magento list | grep encryption:key:change. If the command is not listed, stop and verify the installed release and CLI environment instead of attempting an undocumented substitute. - Change the key. Run
bin/magento encryption:key:change. Wait for completion and treat any error as a failed rotation until it has been investigated. - Flush caches. On Cloud, use
magento-cloud cc. On-premises, runbin/magento cache:flush. This removes cached configuration and application output that may have been generated under the old state. - Re-enable scheduled jobs. On Cloud, use the corresponding ECE Tools command to enable cron again; on-premises, restore the paused crontab.
- Leave maintenance mode. Run
bin/magento maintenance:disableonly after the rotation and cache flush have completed and the application is ready to receive traffic.
Keep a secure record of the newly generated key after the command succeeds. If the command reports an error, leave maintenance mode enabled and cron paused until you know whether the file changed and whether any data was processed.
What happens to sessions after the change?
Key rotation immediately invalidates all customer and administrator sessions, excluding integration users. Customers, staff, and non-integration administrators must authenticate again. This is expected behavior, not evidence that accounts or orders were deleted.
Rank #3
- Spacious 48-Key Capacity: the key cabinet features ample room for up to 48 keys, making it an ideal keys organizer for busy offices, hotels, rental businesses, and large households. Keep all your keys neatly organized and easily accessible in one central location
- Complete Organization Solution: equipped with 48 colorful key tags and 1-48 numbered stickers,, ensuring each key is easily identifiable; This comprehensive locking key box set streamlines key management, eliminating the hassle of misplaced or unidentified keys
- Robust Alloy Steel Construction: crafted from durable alloy steel, this key box ensures long-lasting durability and security. Its sturdy construction makes it an ideal choice for managing multiple keys in any setting, including offices, hotels, and rental homes
- Convenient Wall Mount Installation: this key cabinet wall mount is designed for easy installation with pre-drilled holes and two screws and anchors each; Quick and simple to set up, it offers a secure and accessible location for your key management needs
- Versatile Usage Applications: ideal for various settings, this versatile key cabinet serves as a robust solution for hotels, car rentals, offices, and homes. It's a practical addition to any environment that requires organized and secure key storage
The session effect is why a rotation should not be performed during a busy sales period or silently during an unrelated deployment. Coordinate the maintenance window with support and operations teams, and expect a short-lived increase in login and password-reset questions immediately after the storefront returns.
Re-encrypt data after rotation
Changing the key does not mean every encrypted database value has been rewritten automatically. Adobe documents default re-encryptors for core configuration and sales-order payment data. Run them after the key change:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →bin/magento encryption:data:re-encrypt core_config_data sales_order_paymentThe command names identify the documented data areas: core_config_data for encrypted configuration values and sales_order_payment for protected payment information associated with sales orders. Execute it in the same controlled maintenance window, monitor its output, and verify that it finishes successfully before normal traffic resumes.
Custom encrypted columns
Extensions and custom modules may encrypt columns outside those two default handlers. Such columns require a custom re-encryptor configured for the module. Adobe’s documented approach is based on the SimpleHandler pattern: define which custom data needs to be read with the old key and written with the new key, then run the resulting handler as part of the post-rotation procedure.
Rank #4
- Stable Performance: Built on a printed circuit board, this 20 pin TPM 2.0 module ensures consistent operation under demanding conditions for professional use.
- Simple Setup: Power off your device, locate the TPM slot, and insert the module. The 20 pin configuration ensures a secure fit with clear instructions.
- Enhanced Security: The TPM 2.0 module securely stores encryption keys generated by cryptographic software, protecting PC content from unauthorized access.
- Reliable Replacement: An ideal replacement for damaged or underperforming original TPMs, restoring device security and functionality with durable construction.
- Direct Compatibility: Specifically designed as a direct replacement for HPE 812119 001 and 745821 001, ensuring seamless integration with enterprise devices.
Do not guess that a column is safe because its name does not include “password” or “encrypted.” Inspect the module’s configuration and code, ask its maintainer which fields use Magento’s encryption service, and include those fields in a test migration. A store can appear healthy while a rarely used integration or account setting still contains values that cannot be decrypted.
Verify the store after rotation
Functional checks should cover both ordinary browsing and the protected paths that depend on decryption. Use a non-production test account where possible, then confirm production behavior with the least invasive checks available.
- Open the storefront, category pages, product pages, cart, and checkout.
- Sign in as a customer and verify that the expected account data loads.
- Sign in to the Admin and confirm that configuration pages containing protected values open without decryption errors.
- Place or inspect a test order according to your normal payment-provider test procedure; do not expose live payment credentials while troubleshooting.
- Run the documented data re-encryption command and review its exit status and logs.
- Check cron health, queue consumers, import/export jobs, and integrations that use encrypted credentials.
- Review application and web-server logs for cryptographic, configuration, database, or permission errors.
Integration users are excluded from the automatic session invalidation, but their credentials still depend on correctly available encrypted configuration. A successful customer login alone does not prove that every integration or custom field was re-encrypted.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common failures
The rotation command is missing
If bin/magento list | grep encryption:key:change returns nothing, verify that you are in the correct Magento root, using the expected PHP binary and vendor directory, and running the command as the application owner. Confirm the exact Magento or Adobe Commerce version. Do not use an Admin procedure intended for 2.4.7 or earlier on 2.4.8 and later, where that screen was removed.
Best Value
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9+; Software download required for Mac, visit the SanDisk SecureAccess support page]
env.php is not writable
Check file ownership, mode bits, read-only mounts, and deployment hooks that may replace the file. Correct the issue through your standard infrastructure controls, then rerun the command while maintenance mode and cron remain in the safe state. Avoid making a broad, permanent permission change just to complete one rotation.
Encrypted values fail after deployment or restore
The most likely cause is a mismatch between the key and the data. Confirm that the restored or deployed env.php contains the key associated with that database and that the file was not overwritten by a template. Retrieve the approved recovery copy through the secret-management process, then test decryption in a controlled environment before changing production again.
Free tools Windows power users keep installed
One-click scans. No signup required.
Customers can log in, but an integration fails
Check the integration’s encrypted credentials, cron status, queue consumers, and custom module configuration. Because integration users are not logged out by rotation, a stale process may continue running while holding old configuration in memory. Restart the affected workers or services through your normal operations procedure, then inspect logs for decryption errors.
The re-encryption command reports errors
Keep maintenance mode enabled if the failure could leave data only partly processed. Capture the command output, identify the affected table or record type, and check database connectivity, permissions, and module-specific handlers. For custom columns, confirm that a SimpleHandler-based re-encryptor is configured; the two default arguments do not cover arbitrary extension data.
Recovery and migration rules
Never destroy the previous recovery material immediately after a rotation. Retain it according to your incident-response and backup-retention policy, protected with the same controls as the new key. The old key may be needed to investigate a failed deployment, restore a database snapshot taken before rotation, or recover a file backup that still contains the earlier env.php.
When moving a store to another server or environment, migrate the encrypted data and the matching key as one controlled operation. If you intentionally create a new key for a new environment, plan a complete re-encryption and validation process rather than copying only part of the configuration. Test restores with realistic encrypted configuration, payment records, custom fields, and integration credentials before declaring the migration complete.
Recommended Free Tools
Quick Recap
Key-management checklist
- Locate the secret at
app/etc/env.phpundercrypt.key. - Keep
env.phpout of source control and limit filesystem access. - Store recovery copies in an audited secret-management process.
- For current releases, verify and use
bin/magento encryption:key:change; the Admin rotation screen is not available in 2.4.8 and later. - Use maintenance mode, pause cron, rotate, flush cache, restore cron, and then disable maintenance mode.
- Expect customers and administrators to sign in again; integration users are excluded from that invalidation.
- Run
bin/magento encryption:data:re-encrypt core_config_data sales_order_payment. - Identify and re-encrypt custom encrypted columns with an appropriate custom handler.
- Verify checkout, Admin configuration, cron, queues, integrations, and logs before closing the maintenance window.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
