MongoFlow.Encryption
1.0.0-beta.18
dotnet add package MongoFlow.Encryption --version 1.0.0-beta.18
NuGet\Install-Package MongoFlow.Encryption -Version 1.0.0-beta.18
<PackageReference Include="MongoFlow.Encryption" Version="1.0.0-beta.18" />
<PackageVersion Include="MongoFlow.Encryption" Version="1.0.0-beta.18" />
<PackageReference Include="MongoFlow.Encryption" />
paket add MongoFlow.Encryption --version 1.0.0-beta.18
#r "nuget: MongoFlow.Encryption, 1.0.0-beta.18"
#:package MongoFlow.Encryption@1.0.0-beta.18
#addin nuget:?package=MongoFlow.Encryption&version=1.0.0-beta.18&prerelease
#tool nuget:?package=MongoFlow.Encryption&version=1.0.0-beta.18&prerelease
MongoFlow.Encryption
MongoDB Queryable Encryption for MongoFlow vaults. The members you declare are stored encrypted, and the values your filters compare them with are encrypted too, so they stay queryable. MongoFlow encrypts them itself, with the driver's explicit encryption, so it works on MongoDB Community. It ships with MongoFlow, at the same version.
Installation
dotnet add package MongoFlow.Encryption --prerelease
Usage
Declare what's encrypted, and how it's queried, where the vault is registered:
services.AddMongoVault<CustomerVault>(vault => vault
.UseDatabase("crm")
.UseQueryableEncryption(qe => qe
.KeyVault("encryption", "__keyVault")
.Kms(new LocalKms(masterKey)))
.Collection(x => x.Customers, customers => customers
.Encrypt(x => x.Ssn, EncryptedQuery.Equality) // ==, !=, Contains
.Encrypt(x => x.Salary, EncryptedQuery.Range(0, 1_000_000)) // <, <=, >, >= too
.Encrypt(x => x.Notes))); // encrypted, not queryable
Run the migrator at startup, before the vault is used. It creates the encrypted collections and their data keys, and
rebuilds as encrypted a collection that holds documents already, keeping its documents unencrypted in
{name}.unencrypted until you drop it:
await app.Services.GetRequiredService<IVaultMigrator>().MigrateAllAsync();
Then read and write as with any vault:
var customer = await vault.Customers.FirstOrDefaultAsync(x => x.Ssn == ssn);
vault.Customers.UpdateByKey(customer!.Id, Builders<Customer>.Update.Set(x => x.Ssn, newSsn));
await vault.SaveAsync();
Encrypted documents must ignore extra elements ([BsonIgnoreExtraElements]): the server adds __safeContent__ to each.
MongoDB Search can't index a collection with encrypted members; a vault that encrypts searches its other collections.
More
Queryable Encryption covers query types, setting up and rebuilding collections, what can and can't be queried or written, clients and transactions, and MongoDB Search.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. net11.0 is compatible. |
-
net10.0
- Microsoft.Extensions.DependencyInjection.Abstractions (>= 10.0.12)
- Microsoft.Extensions.Logging.Abstractions (>= 10.0.12)
- MongoDB.Driver (>= 3.12.0)
- MongoDB.Driver.Encryption (>= 3.12.0)
- MongoFlow (>= 1.0.0-beta.18)
- Prest (>= 0.2.1)
- Semver (>= 3.0.0)
-
net11.0
- MongoDB.Driver (>= 3.12.0)
- MongoDB.Driver.Encryption (>= 3.12.0)
- MongoFlow (>= 1.0.0-beta.18)
- Prest (>= 0.2.1)
- Semver (>= 3.0.0)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 1.0.0-beta.18 | 0 | 10/18/2026 |
| 1.0.0-beta.17 | 0 | 10/18/2026 |
| 1.0.0-beta.16 | 0 | 10/18/2026 |
| 1.0.0-beta.15 | 0 | 10/18/2026 |
| 1.0.0-beta.14 | 34 | 10/18/2026 |
| 1.0.0-beta.13 | 37 | 10/17/2026 |
| 1.0.0-beta.12 | 40 | 10/16/2026 |