How to Encrypt and Decrypt a String in PHP

PHP allows encrypting and decrypting a string with many methods. On this page, we focus on one of the Cryptography Extensions, known as OpenSSL. In short, it can be used to encrypt and decrypt data.

This extension binds functions of OpenSSL library for symmetric and asymmetric encryption and decryption, PBKDF2, PKCS7, PKCS12, X509 and other crypto operations. In addition to that it provides implementation of TLS streams.

Encrypting Data with openssl_encrypt()

The <kbd class="highlighted">openssl_encrypt()</kbd> function can be applied for encrypting data in PHP.

The syntax of <kbd class="highlighted">openssl_encrypt()</kbd> will look as follows:

php openssl_encrypt() syntax

string openssl_encrypt( 
  string $data, string $method, string $key,
  int $options = 0, ?string $iv = null, ?string &$tag = null,
  string $aad = '', int $tagLength = 16  
)

On success, it returns the encrypted string. Otherwise, it returns FALSE.

Note: By default, openssl_encrypt() returns the encrypted data as a base64-encoded string.

Decrypting Data with openssl_decrypt()

You can use <kbd class="highlighted">openssl_decrypt()</kbd> for decrypting data in PHP.

The syntax of this function is:

php openssl_decrypt() syntax

string openssl_decrypt( 
  string $data, string $method, string $key,
  int $options = 0, ?string $iv = '', ?string $tag = null, string $aad = ''
)

On success, it returns the decrypted string. Otherwise, it returns FALSE.

Examples of Encrypting and Decrypting a String in PHP

To be more precise, let’s have a look at examples of encrypting and decrypting a string.

Example 1

php encrypt and decrypt a string

<?php

// Storing a string into the variable which
// needs to be Encrypted
$simple_string = "Welcome to W3docs\n";

// Displaying the original string
echo "Original String: " . $simple_string;

// Storing the cipher method
$ciphering = "AES-128-CTR";

// Using OpenSSl Encryption method
$iv_length = openssl_cipher_iv_length($ciphering);
$options = 0;

// Non-NULL Initialization Vector for encryption
$encryption_iv = '1234567891011121';

// Storing the encryption key (16 bytes for AES-128)
$encryption_key = "W3docs1234567890";

// Using openssl_encrypt() function to encrypt the data
$encryption = openssl_encrypt($simple_string, $ciphering, $encryption_key, $options, $encryption_iv);

// Displaying the encrypted string
echo "Encrypted String: " . $encryption . "\n";

// Non-NULL Initialization Vector for decryption
$decryption_iv = '1234567891011121';

// Storing the decryption key
$decryption_key = "W3docs1234567890";

// Using openssl_decrypt() function to decrypt the data
$decryption = openssl_decrypt($encryption, $ciphering, $decryption_key, $options, $decryption_iv);

// Displaying the decrypted string
echo "Decrypted String: " . $decryption;

?>

Try it Yourself »

The output of the code above will be:


 Original String: Welcome to W3docs
 Encrypted String: kZEv65uJVrtngs6rhfX9WG2U
 Decrypted String: Welcome to W3docs

Example 2

In the second example, the string to be encrypted and decrypted is the same, yet the encrypted string randomly changes specifically.

See how it happens below:

encrypt and decrypt a php string

<?php

// Storing a string into the variable which
// needs to be Encrypted
$simple_string = "Welcome to W3docs";

// Displaying the original string
echo "Original String: " . $simple_string . "\n";

// Storing cipher method
$ciphering = "BF-CBC";

// Using OpenSSl encryption method
$iv_length = openssl_cipher_iv_length($ciphering);
$options = 0;

// Using random_bytes() function which gives
// randomly 16 digit values
$encryption_iv = random_bytes($iv_length);

// Alternatively, a fixed 8-character string may be used
// for the IV
$encryption_key = openssl_digest(php_uname(), 'MD5', true);

// Encryption of string process begins
$encryption = openssl_encrypt($simple_string, $ciphering, $encryption_key, $options, $encryption_iv);

// Display the encrypted string
echo "Encrypted String: " . $encryption . "\n";

// Decryption of string process begins
// Reuse the same IV used for encryption
$decryption_iv = $encryption_iv;

// Store the decryption key
$decryption_key = openssl_digest(php_uname(), 'MD5', true);

// Decrypting the string
$decryption = openssl_decrypt($encryption, $ciphering, $decryption_key, $options, $decryption_iv);

// Showing the decrypted string
echo "Decrypted String: " . $decryption;

?>

Try it Yourself »

The output will be:


 Original String: Welcome to W3docs
 Encrypted String: Zm4a3DgDwfrlsYVLmc8iANj1PXw3uCUe
 Decrypted String: Welcome to W3docs

Note: Hardcoding keys and IVs in examples is fine for learning, but in production, always store them securely using environment variables or a secrets manager.

About OpenSSL

OpenSSL is a robust, general-purpose cryptography library that can encompass both symmetric and asymmetric encryption and decryption.

It is licensed under an Apache-style license. Hence, everyone is free to get and use it for both commercial and non-commercial purposes.

For more information, you can check out this source.