Reading the tutorial here: https://github.com/defuse/php-encryption/blob/master/docs/Tutorial.md (scenario #2)

It is advised to store the encryption key in a session variable. I was wondering, is it safer to store the key in a cookie variable instead?

Thread model:

- Against employees of hosting provider snooping data
- Against hackers (they will likely attack the server instead of a user's personal computer)