Latest Version Total Downloads License Laravel Tests

Safely distribute your Laravel applications.

Encrypt your Laravel source code and protect your intellectual property. Converts your PHP files into encrypted code that is decrypted only at runtime. No external extensions required.

Get Started View Commands
terminal
# 1. Require the package
composer require dev-reymark/laravel-source-encryptor
# 2. Initialize package
php artisan source:install
# 3. Build encrypted distribution
php artisan source:build Success
Core Features

Everything you need to protect your source code.

Complete Encryption

Encrypt controllers, models, services, and routes. Your PHP files are compressed and encrypted using AES-256-CBC, and decrypted only at runtime via a custom autoloader.

Single Bundle

Bundle all encrypted code into a single runtime file stored safely inside bootstrap cache. The original app/ directory is completely removed.

Zero Extensions

Works out of the box with standard PHP. No need to install and configure complex C extensions like ionCube on the target server.

Automatic Asset Building

Seamlessly detects and handles Composer and npm builds. Works automatically with API-only apps, Blade, Vue/React Starter Kits, and Vite projects.

Setup

Installation & Configuration

1 Require the Package 

composer require dev-reymark/laravel-source-encryptor

2 Initialize the Package

This command publishes the configuration file and securely generates and injects your SOURCE_ENCRYPTION_KEY into your .env file.

php artisan source:install
Usage

Building Production Distribution

Run the build command to generate your encrypted distribution ready for deployment.

php artisan source:build

Skip Frontend

By default, the build runs npm install and npm run build if it detects assets. Use this flag to skip this step, which is ideal for API-only applications.

php artisan source:build --no-frontend

Skip Composer

By default, the build runs composer install --no-dev inside the new dist/ directory. Use this flag to skip it if you are in a CI/CD pipeline or Docker environment where you prefer to handle Composer installation manually to utilize caching.

php artisan source:build --skip-composer

Configuration & Excluding Directories

You can configure directory and file exclusions inside config/source-encryptor.php. Files and folders listed in the exclude array will be copied to your distribution normally without being encrypted.

'exclude' => [
    // Do not remove 'bootstrap' or 'storage' — Laravel requires these.
    'bootstrap',
    'storage',
    // Add custom directories or files to exclude:
    'app/Http/Controllers/Public',
],

Distribution Structure

A clean distribution folder is created at dist/. The original app/ directory is removed, and your source code is bundled.

dist/
 ├ artisan
 ├ bootstrap/
 │   └ cache/
 │       ├ config.enc
 │       └ source.enc
 ├ composer.json
 ├ composer.lock
 ├ database/
 ├ public/
 ├ resources/
 ├ routes/
 ├ storage/
 └ vendor/
Architecture

How It Works

1

Compress & Encrypt

PHP files are compressed and encrypted using robust AES-256-CBC encryption.

2

Bundle Files

Encrypted code is bundled into a single file at bootstrap/cache/source.enc.

3

Intercept Runtime

During execution, Laravel requests are passed through an EncryptedAutoloader.

Safe Execution

SourceLoader decrypts and executes the PHP. Decrypted source never persists on disk.

Security Notes

  • Keep your SOURCE_ENCRYPTION_KEY absolutely private.
  • Never commit .env to version control.
  • Only distribute the dist/ directory to production servers.