How to Implement "Remember Me" Login in Laravel

Laravel's "remember me" functionality — staying logged in across browser sessions — is built directly into the authentication system, needing only a single boolean argument and a database column that's already present in the default users table migration.

The remember_token column

Schema::create('users', function (Blueprint $table) {
    $table->id();
    // ...
    $table->rememberToken(); // adds a nullable, 100-character remember_token column
});

This column is included in Laravel's default users migration out of the box — no extra setup needed if starting from a standard Laravel installation.

Enabling remember-me on login

public function login(Request $request)
{
    $credentials = $request->validate([
        'email' => 'required|email',
        'password' => 'required',
    ]);

    $remember = $request->boolean('remember');

    if (Auth::attempt($credentials, $remember)) {
        $request->session()->regenerate();
        return redirect()->intended('dashboard');
    }

    return back()->withErrors(['email' => 'Invalid credentials.']);
}

The second argument to Auth::attempt() is the entire feature — passing true generates and stores a remember_token, then sets a long-lived cookie tied to that token; passing false (or omitting it) behaves as a normal session-only login.

The login form's remember-me checkbox

    @csrf
    
    
    
         Remember me
    
    Log in

How the persistent login actually works behind the scenes

When remember-me is enabled, Laravel sets a cookie containing the user's ID and the remember_token value — on a future visit with no active session, Laravel checks this cookie against the token stored in the database and, if it matches, logs the user back in automatically without asking for credentials again.

Checking whether the current session was restored via the remember cookie

if (Auth::viaRemember()) {
    // the current authentication came from the remember cookie,
    // not a fresh login this session
}

Useful for gating a genuinely sensitive action (changing a password, viewing billing details) behind a fresh re-authentication, even for a user whose session was restored via remember-me rather than an active recent login.

Invalidating the remember token on logout, or everywhere

Auth::logout(); // ends the current session, but leaves the remember_token valid on other devices

// to invalidate remember-me on ALL devices (e.g., after a password change)
$request->user()->setRememberToken(Str::random(60));
$request->user()->save();

Rotating the remember_token value invalidates every existing remember-me cookie across every device at once, since none of them will match the new stored value anymore — the standard step to take after a password reset or any other security-sensitive account event.