Magento 2.3 has introduced a new encryption method and requires the encryption key to be 32 characters long / 32 bytes in size.

If you run a setup:upgrade with a wrongly sized encryption key you will get the below error:

secret key size should be SODIUM_CRYPTO_AEAD_CHACHA20POLY1305_IETF_KEYBYTES bytes

You can regenerate the encryption key before the upgrade using the admin panel, but it seems to append the new encryption key to the old one. I believe this is an intended feature for archiving purposes / decrypting old data?

The problem I am facing is: I can update my encryption key on Magento 2.2.x and it will append the new (correctly sized) encryption key to the old one in app/etc/env.php. Everything still works.

But when you upgrade to 2.3, you will still get the error message from above when doing a setup:upgrade. It must look at the field in app/etc/env.php as a whole, and figure out it isn't 32 characters long (because the old encryption key is on the line above the new one).

Does anyone know if appending the new encryption key to the old one is intended behaviour? And if it is safe to remove the old encryption key so we can proceed with the 2.3 upgrade?


  • 3
    We hit this issue with several UK stores, turned out there was an issue with the values from Ebizmarts SagePay extensions, we backed up these values, cleared them out then could run setup:upgrade and then restore the values afterwards. Turns out the Ebiz extension wasn't compatible with the new 2.3 method of encrypting data.
    – Aron Moss
    Jun 26, 2019 at 16:12

1 Answer 1


This can be fixed by adding a 32 character key on a newline to the key. (this is not ideal but does work). For example, before: app/etc/config.php

'crypt' => [
        'key' => 'akeythatisnolongenough',


'crypt' => [
        'key' => 'akeythatisnolongenough

This allows magento to try the first key, but then use the new key for future. We hit this issue whilst automatically upgrading instances on Mdoq

  • my self code like this in app/etc/env.php - 'crypt' => [ 'key' => 'admin', ], what to change here
    – User0434
    Sep 19, 2019 at 10:56
  • This is correct. I ran into a similar issue but upon changing the crypt key through the admin, Magento added the new key below the old one.
    – dchayka
    Jan 20, 2020 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.