I understand you want to put something safely stored into a database. You also do not want it to be decryptable by someone getting ahold of the database.
This first and foremost means: You cannot store the key on the same server as the database. But it has other implications. If you are using the inbuilt laravel helper function encrypt()
it actually means that the server uses the same password (secret) to encrypt all of the data you feed it. So if you have two customers they will have the same secret key and thus someone who got ahold of the key will be able to decrypt the whole database.
Second: Laravel stored the key typically in the /.env
file in laravels root dir on the server. That means: if someone can access the servers files (and even worse if the sql db is on the same server) - the encryption is useless.
What to do? There are multiple ways around it. My preferred option is to use asymetric encryption using OpenPGP. There already is some proper implementation you can use and even a very good reference project wich i encourage you to have a look at: Pass
The data needs to be synced between devices, and should not be accessable without decryption from the client (just like a LastPass vault is not decrypt-able by LastPass themselves).
That is something you can achieve in several ways. But afaik there is no way around storing (at least) the decryption keys on the client (and on the client only) and thus only transfer encrypted from the client to whatever server or "cloud" you will eventually decide on using. The encryption and decryption must be done on the client then.
If you decide on having a webapplication there probably is some way in doing this using JavaScript and storing a secret in the browser but I don't really have a good working example atm.
If you stick to Public/Private keypairs you might as well use the public key to encrypt information from everywhere but only decrypt it on the client (where the private key is stored). Remember though: If some plaintext information is processed on the server it can be caught by someone who as access to it before encryption.
I hope that answers your question at least roughly.
PBKDF2
is not an encryption method. please stop your development while you're only slightly behind. there's no need to encrypt on the server/transport if you're under E2E anyway.