Docs Menu
Docs Home
MongoDB Manual
/ / /

Queryable Encryption

On this page

  • Introduction
  • Considerations
  • Compatibility
  • MongoDB Support Limitations
  • Features
  • Install
  • Quick Start
  • Fundamentals
  • Tutorials
  • Reference

Queryable Encryption gives you the ability to perform the following tasks:

  • Encrypt sensitive data fields from the client-side.

  • Store sensitive data fields as fully randomized encrypted data on the database server-side.

  • Run expressive queries on the encrypted data.

These tasks are all completed without the server having knowledge of the data it's processing.

Sensitive data is encrypted throughout its lifecycle - in-transit, at-rest, in-use, in logs, and backups - and only ever decrypted on the client-side, since only you have access to the encryption keys.

Queryable Encryption introduces an industry-first fast, searchable encryption scheme developed by the pioneers in encrypted search. The feature supports equality searches, with additional query types such as range, prefix, suffix, and substring planned for future releases.

You can set up Queryable Encryption using the following mechanisms:

  • Automatic Encryption: Enables you to perform encrypted read and write operations without you having to write code to specify how to encrypt fields.

  • Explicit Encryption: Enables you to perform encrypted read and write operations through your MongoDB driver's encryption library. You must specify the logic for encryption with this library throughout your application.

When implementing an application that uses Queryable Encryption, consider the points listed in Security Considerations.

For other limitations, see Queryable Encryption limitations.

The following table shows which MongoDB server products support which Queryable Encryption mechanisms:

Product Name
Supports Automatic Encryption
Supports Explicit Encryption
MongoDB Atlas
MongoDB Enterprise Advanced
MongoDB Community Edition

To learn which MongoDB drivers support Queryable Encryption, see Queryable Encryption Compatibility.

Enabling Queryable Encryption on a collection redacts fields from some diagnostic commands and omits some operations from the query log. This limits the data available to MongoDB support engineers, especially when analyzing query performance. To measure the impact of operations against encrypted collections, use a third party application performance monitoring tool to collect metrics.

For details, see Redaction.

To learn about the security benefits of Queryable Encryption for your applications, see the Features page.

To learn what you must install to use Queryable Encryption, see the Install a Queryable Encryption Compatible Driver and Install and Configure a Queryable Encryption Library pages.

To start using Queryable Encryption, see the Quick Start.

To learn about encryption key management, see Encryption Keys and Key Vaults.

To learn how Queryable Encryption works, see the Fundamentals section, which contains the following pages:

To learn how to perform specific tasks with Queryable Encryption, see the Tutorials section.

To view information to help you develop your Queryable Encryption enabled applications, see the Reference section.

The reference section contains the following pages:

← KMS Providers