Install and Configure mongocryptd for CSFLE
On this page
The automatic feature of field level encryption is only available in MongoDB Enterprise 4.2 or later, and MongoDB Atlas 4.2 or later clusters.
mongocryptd is installed with MongoDB Enterprise
Server (version 4.2 and later).
When you create a CSFLE-enabled MongoDB client, the
process is automatically started by default and handles the following
Uses the specified automatic encryption rules to mark fields in read and write operations for encryption.
Prevents unsupported operations from being executed on encrypted fields.
Parses the encryption schema specified to the database connection. Automatic encryption rules use a strict subset of JSON schema syntax. If the automatic encryption rules contain invalid automatic encryption syntax or any
mongocryptdreturns an error.
mongocryptd is only responsible for the above functions, and does
not perform any of the following:
mongocryptddoes not perform encryption or decryption itself
mongocryptddoes not access any encryption key material
mongocryptddoes not listen over the network
Drivers compatible with MongoDB 4.2 and later use the Apache-licensed libmongocrypt library for performing client-side field level encryption and automatic decryption.
The official MongoDB 4.2+ compatible drivers,
and the 4.2 or later legacy
mongo shell require access to
mongocryptd process on the client host machine. These clients
search for the
mongocryptd process in the system PATH by default.
For supported Linux Operating Systems, install the Server package by following the
install on Linux tutorial
, follow the documented installation instructions and install the
mongodb-enterprise server package. Alternatively, specify
mongodb-enterprise-cryptd instead to install only the
mongocryptd binary. The package manager installs
the binaries to a location in the system PATH (e.g.
For OSX, install the Server package by following the install on MacOS tutorial. The package manager installs binaries to a location in the system PATH.
For Windows, install the Server package by following the
install on Windows tutorial.
You must add the
mongocryptd package to your system PATH after
installation. Defer to documented best practices for your Windows
installation for instructions on adding the
mongocryptd binary to
the system PATH.
For installations via an official tarball or ZIP archive,
follow the documented best practices for your operating system to add
mongocryptd binary to your system PATH.
If the 4.2+ compatible driver has access to the
by default the driver manages the spawning of the
mongocryptd Port In Use
mongocryptd process is already running on the port specified
by the driver, the driver may log a warning and continue to operate
without spawning a new process. Any settings specified by the driver
only apply once the existing process exits and a new encrypted client
attempts to connect.
You can configure how your driver starts
mongocryptd through the
The port from which
Number of idle seconds in which the
The URI from which to run a
The full path to
Default: Defaults to empty string and spawns from the system path.
Start on Boot
If possible, we recommend that
mongocryptd be started on boot,
rather than launched on demand.
To view examples of how to configure your
process, click the tab corresponding to the driver you are using in