In this video I’m showing you a new Laravel 11 feature: encryption key rotation. I start by demoing a super simple setup in web.php with two routes—one to encrypt whatever you pass in a data query param, and another to decrypt it. You’ll see how Laravel can encrypt a string, then successfully decrypt the encrypted value back to the original text, all using the APP_KEY behind the scenes. Then I explain the real-world problem: sometimes you need to change your APP_KEY (for example, after a security issue). But if you rotate the key the old way, anything encrypted with the previous key—cookies, sessions, and even encrypted database values—can break, and you’ll hit errors like “MAC is invalid.” Laravel 11 solves this with APP_PREVIOUS_KEYS. I duplicate the old key into APP_PREVIOUS_KEYS, generate a new APP_KEY, and show that Laravel will encrypt with the new key but still decrypt older values by trying previous keys. The takeaway is simple: you can rotate keys more safely without immediately breaking existing encrypted data.