What You Will Learn

• How JPA AttributeConverter works.
• How converters can encrypt and decrypt fields.
• Where this approach is useful.
• Limitations around search and indexing.
• Production cautions.

Introduction

JPA AttributeConverter can transform an entity field before saving it and after reading it.

This makes it useful for transparent encryption.

Converter Flow

flowchart LR
    A["Entity plain field"] --> B["convertToDatabaseColumn"]
    B --> C["Encrypted database value"]
    C --> D["convertToEntityAttribute"]
    D --> E["Plain entity field"]

Example Converter

@Converter
public class SensitiveStringConverter implements AttributeConverter<String, String> {

    private final EncryptionService encryptionService;

    public SensitiveStringConverter(EncryptionService encryptionService) {
        this.encryptionService = encryptionService;
    }

    @Override
    public String convertToDatabaseColumn(String value) {
        return value == null ? null : encryptionService.encrypt(value);
    }

    @Override
    public String convertToEntityAttribute(String value) {
        return value == null ? null : encryptionService.decrypt(value);
    }
}

Entity Usage

@Convert(converter = SensitiveStringConverter.class)
private String taxId;

Benefits

• Centralized encryption logic.
• Less repeated service code.
• Transparent persistence integration.
• Useful for selected sensitive fields.

Limitations

• Encrypted fields are hard to search.
• Sorting encrypted values is not meaningful.
• Key rotation needs planning.
• Decrypted values can still leak through logs or DTOs.

Summary

JPA converters can simplify encryption for selected fields, but production systems still need key management, masking, authorization, and search design.

Learning Path Navigation

• Series home: Spring Security Learning Path
• Previous: Field-Level Encryption in Spring Boot
• Next: Secrets Management using AWS Secrets Manager