java 57 lines · 10 steps

Transparent column encryption in Spring & JPA

A JPA AttributeConverter that AES-GCM encrypts String fields on the way into the database and decrypts them on the way out.

Explained by highlit

Spring Advanced encryption aes-gcm jpa-converter dependency-injection cryptography

1@Component
2@Converter
3public class EncryptedStringConverter implements AttributeConverter<String, String> {
4 
  private static final String ALGORITHM = "AES/GCM/NoPadding";
  private static final int GCM_TAG_BITS = 128;
  private static final int IV_LENGTH = 12;
8 
  private final SecretKey secretKey;
  private final SecureRandom secureRandom = new SecureRandom();
11 
  public EncryptedStringConverter(@Value("${app.encryption.key}") String base64Key) {
      byte[] keyBytes = Base64.getDecoder().decode(base64Key);
      this.secretKey = new SecretKeySpec(keyBytes, "AES");
  }
16 
  @Override
  public String convertToDatabaseColumn(String attribute) {
      if (attribute == null) {
          return null;
      }
      try {
          byte[] iv = new byte[IV_LENGTH];
          secureRandom.nextBytes(iv);
          Cipher cipher = Cipher.getInstance(ALGORITHM);
          cipher.init(Cipher.ENCRYPT_MODE, secretKey, new GCMParameterSpec(GCM_TAG_BITS, iv));
          byte[] encrypted = cipher.doFinal(attribute.getBytes(StandardCharsets.UTF_8));
          byte[] combined = ByteBuffer.allocate(iv.length + encrypted.length)
                  .put(iv)
                  .put(encrypted)
                  .array();
          return Base64.getEncoder().encodeToString(combined);
      } catch (GeneralSecurityException e) {
          throw new IllegalStateException("Failed to encrypt column value", e);
      }
  }
37 
  @Override
  public String convertToEntityAttribute(String dbData) {
      if (dbData == null) {
          return null;
      }
      try {
          byte[] combined = Base64.getDecoder().decode(dbData);
          ByteBuffer buffer = ByteBuffer.wrap(combined);
          byte[] iv = new byte[IV_LENGTH];
          buffer.get(iv);
          byte[] cipherText = new byte[buffer.remaining()];
          buffer.get(cipherText);
          Cipher cipher = Cipher.getInstance(ALGORITHM);
          cipher.init(Cipher.DECRYPT_MODE, secretKey, new GCMParameterSpec(GCM_TAG_BITS, iv));
          return new String(cipher.doFinal(cipherText), StandardCharsets.UTF_8);
      } catch (GeneralSecurityException e) {
          throw new IllegalStateException("Failed to decrypt column value", e);
      }
  }
57}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1An AttributeConverter lets you intercept persistence at the field level so encryption stays invisible to your entity and query code.
2AES-GCM needs a fresh random IV per encryption, which you must store alongside the ciphertext to decrypt later.
3Prepending the IV to the ciphertext gives you a single self-contained blob that carries everything decryption requires.

Related explainers

typescript

import { registerLocaleData } from '@angular/common';
import localeFr from '@angular/common/locales/fr';
import localeFrExtra from '@angular/common/locales/extra/fr';
import localeDe from '@angular/common/locales/de';

Locale-aware bootstrapping in Angular

i18n localization dependency-injection

Intermediate 8 steps

typescript

import { Module } from '@nestjs/common';
import { ConfigModule } from '@nestjs/config';
import * as Joi from 'joi';

Validating env config at boot in NestJS

configuration schema-validation environment-variables

Intermediate 8 steps

typescript

import { Inject, Injectable, Logger } from '@nestjs/common';
import { CACHE_MANAGER } from '@nestjs/cache-manager';
import { Cache } from 'cache-manager';
import { InjectRepository } from '@nestjs/typeorm';

A cache-aside country lookup in NestJS

cache-aside dependency-injection batch-lookup

Intermediate 8 steps

java

package com.acme.billing.config;
 
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.context.properties.ConfigurationProperties;

Feature-flagged beans with Spring @ConditionalOnProperty

feature-flags conditional-beans strategy-pattern

Intermediate 5 steps

typescript

import { Injectable, effect, signal, computed } from '@angular/core';
 
interface Preferences {
  theme: 'light' | 'dark';

A signal-based preferences store in Angular

signals state-management persistence

Intermediate 7 steps

java

public static Map<String, String> parseCookieHeader(String header) {
    Map<String, String> cookies = new LinkedHashMap<>();
    if (header == null || header.isBlank()) {
        return cookies;