Narwhals Poke Mammals


    1.0.4 • Public • Published


    License: MIT npm (scoped) node-current (scoped) Build Status Coverage Status

    EncryptedString type for Mongoose schemas. Provides AES-256-CBC encryption-at-rest for strings.


    var mongoose = require('mongoose');
    const mes = require('@tsmx/mongoose-encrypted-string');
    const key = 'YOUR KEY HERE';
    // register the new type EncryptedString
    mes.registerEncryptedString(mongoose, key);
    // use EncryptedString in your schemas
    Person = mongoose.model('Person', {
        id: { type: String, required: true },
        firstName: { type: mongoose.Schema.Types.EncryptedString },
        lastName: { type: mongoose.Schema.Types.EncryptedString }
    let testPerson = new Person(); = 'id-test';
    testPerson.firstName = 'Hans'; // stored encrypted
    testPerson.lastName = 'Müller'; // stored encrypted
    let queriedPerson = await Person.findOne({ id: 'id-test' });
    console.log(queriedPerson.firstName); // 'Hans', decrypted automatically
    console.log(queriedPerson.lastName); // 'Müller, decrypted automatically

    Directly querying the MongoDB will return the encrypted data.

    > db.persons.findOne({ id: 'id-test' });
            "_id" : ObjectId("5f8576cc0a6ca01d8e5c479c"),
            "id" : "id-test",
            "firstName" : "66db1589b5c0de7f98f5260092e6799f|a6cb74bc05a52d1244addb125352bb0d",
            "lastName" : "2b85f4ca2d98ad1234da376a6d0d9128|d5b0257d3797da7047bfea6dfa62e19c",
            "__v" : 0


    registerEncryptedString(mongoose, key)

    Registers the new type EncryptedString in the mongoose instance's schema types. Encryption/decryption is done with AES-256-CBC using the given key. After calling this funtion you can start using the new type via mongoose.Schema.Types.EncryptedString in your schemas.


    The mongoose instance where EncryptedString should be registered.


    The key used for encryption/decryption. Length must be 32 bytes. See notes for details.

    Use with lean() queries

    For performance reasons it maybe useful to use Mongoose's lean() queries. Doing so, the query will return the raw JSON objects from the MongoDB database where all properties of type EncryptedString are encrypted.

    To get the clear text values back you can directly use @tsmx/string-crypto which is also used internally in this package for encryption and decryption.

    const key = 'YOUR KEY HERE';
    const sc = require('@tsmx/string-crypto');
    // query raw objects with encrypted string values
    let person = await Person.findOne({ id: 'id-test' }).lean();
    // decrypt using string-crypto
    let firstName = sc.decrypt(person.firstName, { key: key });
    let lastName = sc.decrypt(person.lastName, { key: key });


    • Encryption/decryption is done via the package @tsmx/string-crypto.
    • Key length must be 32 bytes. The key can be provided as
      • a string of 32 characters length, or
      • a hexadecimal value of 64 characters length (= 32 bytes)
    • Don't override getters/setter for EncryptedString class or schema elements of this type. This would break the encryption.


    npm i @tsmx/mongoose-encrypted-string

    DownloadsWeekly Downloads






    Unpacked Size

    11.1 kB

    Total Files


    Last publish


    • tsmx