How to secure app.php encryption key? (Laravel 5) -

according this, laravel supports encryption , decryption of data. works , easy set up, question how secure really?

what if encrypted fields in database compromised , app.php file compromised? have access encryption key.

is there way can programmatically secure encryption key hackers?

this answer helpful, i'm wondering if there specific method laravel apps. appreciated!

laravel's encryption strong, uses aes algorithm through mcrypt, known php extension.

if encrypted fields , encryption key falls wrong hands you're pretty screwed , there's nothing it.

fortunately, there ways secure key. first of all, don't ever put key inside app.php file. laravel 5 makes easier ever use environments. put key inside .env file , refer inside app.php file.

as files lay outside reach of code run through public folder, you're go. if bad intentions finds way ssh or ftp server, approach won't save no 1 else will.

i don't know planning on encrypt on off chance thinking securing passwords through encryption, please read on.