I have a "cloud service", which consists of 2 parts:

  • Web application, written in Next.js;
  • MongoDB database (uses MongoDB Atlas).

I allow users to sign in with GitHub and handle authentication using JWT. User can create & delete text files, which are saved in the database as so:

    "name": string,
    "content": string,
    "owner": number    <-- User ID

I would like to encrypt the content so that I can't see it in the database. I was thinking about using the Web Crypto API, but I'm not sure how I'm going to store the encryptions/decryption key securely.

What's the best way to handle this case and which encryption algorithm should I use?

  • well, you've forgot to define who should be the owner of the keys? Part of this smells like you should state the problem before asking about a solution: Why are you encrypting parts of the data? For which purpose? That will answer what kind of cryptographic construct you need to do. I'm honestly not convinced there's even any application benefit, as far as you've described your whole system. Commented Jun 30, 2020 at 8:03
  • (also, your use case looks super much like a relational database, not for the data inconsistency shipwreck that the key-value/dictionary store that MongoDB is, but you should be consulting with dba.stackexchange.com what the right database for your problem is. Operating secure and safe databases is nontrivial, and honestly, MongoDB does a lot to make it harder. MongoDB regularly makes me feel that people are happy to throw out 50 years of knowledge to use some beta-grade, but hyped, software that allegedly "scales", but doesn't "work".) Commented Jun 30, 2020 at 8:07

1 Answer 1


Announced 7 June 2022:

Queryable Encryption is a feature that enables you to encrypt data in your application before you send it over the network to MongoDB while still maintaining the ability to query the encrypted data. With Queryable Encryption enabled, no MongoDB-managed service has access to your data in an unencrypted form.



But @Marcus Müller's warning makes me skeptical.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .