Laravel's "remember me" feature keeps a user logged in across browser sessions using a separate long-lived cookie and database token — mechanically distinct from the normal session, which is exactly why it survives closing the browser entirely.
Enabling it in the login form
Passing the checkbox value to Auth::attempt()
public function login(Request $request)
{
$credentials = $request->validate([
'email' => 'required|email',
'password' => 'required',
]);
if (Auth::attempt($credentials, $request->boolean('remember'))) {
$request->session()->regenerate();
return redirect()->intended('dashboard');
}
return back()->withErrors(['email' => 'Invalid credentials.']);
}The second argument to Auth::attempt() is what actually enables remember-me for this login — when true, Laravel generates and stores a long-lived remember_token for the user and sets a corresponding cookie, separate entirely from the session cookie.
The required database column
Schema::table('users', function (Blueprint $table) {
$table->rememberToken(); // adds a nullable remember_token VARCHAR(100) column
});This column (included by default in Laravel's standard users migration) is where the remember token is actually stored — without it, enabling $remember in Auth::attempt() has no effect at all, since there's no column to persist the token to.
Why remember-me survives a closed browser but a normal session doesn't
A normal session cookie is typically a "session cookie" with no fixed expiration, meaning it's deleted automatically when the browser fully closes — the remember-me cookie is instead a persistent cookie with a genuinely long expiration (commonly around 5 years by default in Laravel), which is precisely the mechanism that lets a user return days later, with a closed browser in between, and still be automatically logged in.
Checking if the current user was authenticated via remember-me
if (Auth::viaRemember()) {
// this session was restored via the remember-me cookie, not a fresh login
}This is genuinely useful for a feature requiring a recent, explicit password entry (like changing account settings or viewing sensitive billing information) — a check like this can prompt for password re-confirmation specifically when the session was restored via remember-me rather than a fresh login.
Invalidating the remember token on logout
public function logout(Request $request)
{
Auth::logout();
$request->session()->invalidate();
$request->session()->regenerateToken();
return redirect('/');
}Auth::logout() already handles clearing the remember-me cookie and regenerating the stored token as part of its normal behavior — no additional manual step is needed specifically for the remember-me mechanism beyond the standard logout call.
Forcing all of a user's other sessions to log out (invalidating remember-me everywhere)
Auth::logoutOtherDevices($currentPassword);This regenerates the user's stored remember token, which immediately invalidates every remember-me cookie issued to any other browser or device — genuinely useful as a "log out everywhere else" security feature, requiring the current password as confirmation before taking this broader action.