> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt

# Queryable Encryption Limitations

## Overview

Consider these limitations and restrictions before enabling Queryable Encryption. Some operations are unsupported, and others behave differently.

For compatibility limitations, please read [Compatibility.](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/compatibility.md#std-label-qe-csfle-compatibility)

## Security Guarantees

**Warning:**

Queryable Encryption defends against data exfiltration, not against adversaries with persistent access to an environment, or those who can retrieve both database snapshots and accompanying query transcripts/logs.

When using Queryable Encryption, equality and range queries offer similar security against attackers with database snapshots. However, an attacker with access to both database snapshots and query information is beyond the scope of Queryable Encryption's security guarantees. This is **especially** true for range queries, even if only a small number of query transcripts or logs are retrieved. See [6.1: Range Queries in the Persistent Model](https://cdn.bfldr.com/2URK6TO/as/64kp46t53v34xw37gkngbrg/An_Overview_of_Queryable_Encryption) in the overview whitepaper for details.

## MongoDB Support Limitations

Enabling Queryable Encryption on a collection redacts fields from some diagnostic commands and omits some operations from the query log. This limits the data available to MongoDB support engineers, especially when analyzing query performance. To measure the impact of operations against encrypted collections, use a third party application performance monitoring tool to collect metrics.

For details, see the [Redaction](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/limitations.md#std-label-qe-redaction) section of this page.

## Supported Operations

Queryable Encryption supports a subset of commands, query operators, update operators, aggregation stages, and aggregation expressions. For the list of supported operations, see [Supported Operations for Queryable Encryption.](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-reference-automatic-encryption-supported-operations)

## Manual Metadata Collection Compaction

Manually run [metadata collection compaction](https://www.mongodb.com/docs/manual/core/queryable-encryption/fundamentals/manage-collections.md#std-label-qe-metadata-compaction) when your metadata collections exceed 1 GB. Compaction decreases the size of the metadata collections associated with encrypted fields, and improves performance.

## Modifying the `encryptedFieldsMap`

Do not modify the `encryptedFieldsMap` passed to your `MongoClient`. Doing so can result in unexpected and incorrect behavior when querying.

Queryable Encryption encrypts the set of fields in the  [encryptedFieldsMap](https://www.mongodb.com/docs/manual/core/queryable-encryption/fundamentals/encrypt-and-query.md#std-label-qe-fundamentals-encrypt-query) configuration that you pass to your `MongoClient` constructor. If you specify a formerly plaintext field in your `encryptedFieldsMap` configuration that exists in the collection documents, you can only query on that field for documents inserted after you updated your `encryptedFieldsMap` configuration.

For example, consider a database in which you have inserted documents with a plaintext `streetAddress` field. Adding this field to `encryptedFieldsMap` and performing subsequent inserts will insert the encrypted value of `streetAddress` into the database. The driver will send future queries for a specific `streetAddress` as [`BinData`](https://www.mongodb.com/docs/manual/reference/mongodb-extended-json-v1.md#mongodb-bsontype-data_binary). As a result, the plaintext values in the original documents will never match future queries.

### The \_id Field

You cannot configure Queryable Encryption to encrypt the `_id` field because it relies on the value auto-generated by MongoDB.

### Encrypted Field Names

You can't rename an encrypted field. For example, if you specify `ssn` as a field to encrypt, you can't [`$rename`](https://www.mongodb.com/docs/manual/reference/operator/update/rename.md#mongodb-update-up.-rename) the field name to `taxPayerID`.

### Modifying Queryable Fields

The query type you specify for a field when creating the collection in `encryptedFieldsMap` is immutable. You cannot enable new query types to an existing field, and you cannot change the existing query type.

## Redaction

To improve security, Queryable Encryption redacts fields from some diagnostic commands on encrypted collections, and omits certain operations from the query log. An encrypted collection is any collection with the `encryptedFields` option.

### Query Log and Database Profiler Redaction

The CRUD operations below are omitted from the [slow operations](https://www.mongodb.com/docs/manual/reference/log-messages.md#std-label-log-message-slow-ops) query log and the [Database Profiler](https://www.mongodb.com/docs/manual/reference/database-profiler.md#std-label-profiler) `system.profile` collection when you run them on an encrypted collection.

- [`aggregate`](https://www.mongodb.com/docs/manual/reference/command/aggregate.md#mongodb-dbcommand-dbcmd.aggregate)

- [`compactStructuredEncryptionData`](https://www.mongodb.com/docs/manual/reference/command/compactstructuredencryptiondata.md#mongodb-dbcommand-dbcmd.compactStructuredEncryptionData)

- [`count`](https://www.mongodb.com/docs/manual/reference/command/count.md#mongodb-dbcommand-dbcmd.count)

- [`delete`](https://www.mongodb.com/docs/manual/reference/command/delete.md#mongodb-dbcommand-dbcmd.delete)

- [`find`](https://www.mongodb.com/docs/manual/reference/command/find.md#mongodb-dbcommand-dbcmd.find)

- [`findAndModify`](https://www.mongodb.com/docs/manual/reference/command/findandmodify.md#mongodb-dbcommand-dbcmd.findAndModify)

- [`insert`](https://www.mongodb.com/docs/manual/reference/command/insert.md#mongodb-dbcommand-dbcmd.insert)

- [`update`](https://www.mongodb.com/docs/manual/reference/command/update.md#mongodb-dbcommand-dbcmd.update)

- [`db.collection.bulkWrite()`](https://www.mongodb.com/docs/manual/reference/method/db.collection.bulkwrite.md#mongodb-method-db.collection.bulkWrite)

- The `cleanupStructuredEncryptionData` command

### Command and Aggregation Stage Output Redaction

The [`collStats`](https://www.mongodb.com/docs/manual/reference/command/collstats.md#mongodb-dbcommand-dbcmd.collStats) command and [`$collStats`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/collstats.md#mongodb-pipeline-pipe.-collStats) aggregation stage:

- Omit `"queryExecStats"`

- Omit `"latencyStats"`

- Redact `"WiredTiger"`, if present, to include only the `url` field.

The [`currentOp`](https://www.mongodb.com/docs/manual/reference/command/currentop.md#mongodb-dbcommand-dbcmd.currentOp) command and [`$currentOp`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/currentop.md#mongodb-pipeline-pipe.-currentOp) aggregation stage:

- Omit all fields after `"command"`.

- Redact `"command"` to include only the first element, `$comment`, and `$db`.

The [`top`](https://www.mongodb.com/docs/manual/reference/command/top.md#mongodb-dbcommand-dbcmd.top) command only returns the collection name of encrypted collections.

The [`$planCacheStats`](https://www.mongodb.com/docs/manual/reference/operator/aggregation/plancachestats.md#mongodb-pipeline-pipe.-planCacheStats) aggregation stage omits operations against encrypted collections, even though the operations are cached as normal.

## Topology Support

- Replica sets and sharded clusters are supported

- Standalone deployments are not supported

- Secondary reads are not supported

## Sharding

- Metadata collections must not be sharded

- Shard keys must not be encrypted fields

## Collections

- You cannot use Client-Side Field Level Encryption with Queryable Encryption on the same collection.

  - Queryable Encryption does not support migration from collections encrypted with Client-Side Field Level Encryption. You must decrypt your documents and insert them one-by-one.

  - Queryable Encryption does not support automatic migration from an unencrypted collection. You must insert the documents one-by-one.

- Queryable Encryption supports new collections only. You cannot add or remove Queryable Encryption to existing collections.

- You cannot rename a collection with encrypted fields.

- You cannot specify `jsonSchema` to [`db.createCollection()`](https://www.mongodb.com/docs/manual/reference/method/db.createcollection.md#mongodb-method-db.createCollection) when creating a Queryable Encryption collection if the `jsonSchema` contains the `encrypt` keyword.

  - You can specify both `encryptedFields` and `jsonSchema` to [`db.createCollection()`](https://www.mongodb.com/docs/manual/reference/method/db.createcollection.md#mongodb-method-db.createCollection) as long as your [jsonSchema](https://www.mongodb.com/docs/manual/core/schema-validation.md#std-label-schema-validation-overview) does not contain validation for encrypted fields.

- Queryable Encryption does not support [Views](https://www.mongodb.com/docs/manual/core/views.md#std-label-views-landing-page), [Time Series Collections](https://www.mongodb.com/docs/manual/core/timeseries-collections.md#std-label-manual-timeseries-collection), or [capped collection.](https://www.mongodb.com/docs/manual/core/capped-collections.md#std-label-manual-capped-collection)

- Queryable Encryption does not support [TTL Indexes](https://www.mongodb.com/docs/manual/core/index-ttl.md#std-label-index-feature-ttl) or [Unique Indexes.](https://www.mongodb.com/docs/manual/core/index-unique.md#std-label-index-type-unique)

- You cannot disable `jsonSchema` validation.

- When a collection uses the `encryptedFields` option:

  - You cannot set `validationLevel` to `none`.

  - You cannot set `validationAction` to `warn`.

### Drop Collection

- Dropping collections from a `MongoClient` that is not configured for Queryable Encryption doesn't drop the associated metadata collections. `mongod` logs a warning if you drop a collection with encrypted fields before dropping the metadata collections.

**Tip:**

When dropping a collection with a `MongoClient` configured for Queryable Encryption, compatible drivers drop the associated metadata collections as well.

### Create Collection

Always explicitly create any collections that use Queryable Encryption. Implicit collection creation doesn't create the necessary indexes and metadata collections, resulting in poor query performance.

## Arrays

Queryable Encryption does not support automatic encryption on fields within an array of documents.

## Views

Applications cannot rely on the automatic encryption validation to prevent unsupported queries against views on collections with encrypted fields.

Queries against [views](https://www.mongodb.com/docs/manual/core/views.md#std-label-views-landing-page) on collections containing values encrypted with Queryable Encryption may return unexpected or incorrect results if either the underlying view aggregation pipeline *or* the query references encrypted fields. If creating a view on a collection containing values encrypted with Queryable Encryption, avoid operating on encrypted fields to mitigate the risk of unexpected or incorrect results.

For more information on views, see [Views.](https://www.mongodb.com/docs/manual/core/views.md#std-label-views-landing-page)

## Collation

Queryable Encryption ignores user-specified collations or collection default collations. Encryption obscures the field value and prevents normal collation behavior. Collation-sensitive queries against encrypted fields may return unexpected or incorrect results.

For more information on collations, see [Collation Document.](https://www.mongodb.com/docs/manual/reference/collation.md#std-label-collation-document-fields)

Queryable Encryption-compatible drivers have a list of [supported operations for automatic encryption](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-reference-automatic-encryption-supported-operations). For unsupported read and write operations, the underlying support library cannot introspect the collection catalog to identify the default collation. Applications therefore cannot rely on the Queryable Encryption validation to prevent querying on encrypted fields with collation defaults.

## Indexes on Encrypted Fields

Do not create indexes on encrypted fields. Creating indexes on encrypted fields that use Queryable Encryption negatively affect performance. Instead, you can create an index on the `__safeContent__` field to support queries on encrypted fields.

## Unique Indexes

[Unique indexes](https://www.mongodb.com/docs/manual/core/index-unique.md#std-label-index-type-unique) can't guarantee uniqueness if the index key specifies any encrypted fields.

Queryable Encryption always outputs a different encrypted value, even for the same input. The server considers each encrypted value unique, even though the decrypted value may not be. This means that even if a collection uses an index-enforced unique constraint on fields, the collection can still contain multiple documents with duplicate plaintext values for that field.

Queryable Encryption compatible drivers configured for automatic encryption [support some operations for automatic encryption](https://www.mongodb.com/docs/manual/core/queryable-encryption/reference/supported-operations.md#std-label-qe-reference-automatic-encryption-supported-operations). For unsupported read and write operations, the underlying library can't introspect the index catalog to identify a given field as unique. Applications can't rely on automatic encryption validation to prevent unique constraint violations on randomly-encrypted fields.