fle-nodejs

name	fle-nodejs
summary	Field-Level Encryption with the Couchbase Node.js SDK — CryptoManager setup, encrypting and decrypting document fields
description	Field-Level Encryption with the Couchbase Node.js SDK — CryptoManager setup, encrypting and decrypting document fields
compatibility	Node.js SDK 4.x. couchbase-encryption npm package required.
metadata	{"last_verified":"2026-05","min_server_version":"6.0","handoff":[{"condition":"user asks about FLE concepts or supported SDKs","skill":"fle"},{"condition":"user asks about connection setup","skill":"server-connection-nodejs"}]}

Field-Level Encryption — Node.js

Setup

npm install couchbase couchbase-encryption

Configure CryptoManager

const couchbase = require('couchbase');
const { AeadAes256CbcHmacSha512Provider, DefaultCryptoManager, Key } =
    require('couchbase-encryption');

const keyBytes = Buffer.alloc(64); // 64-byte key for AES-256
const provider = new AeadAes256CbcHmacSha512Provider({
    keys: { 'my-key-id': keyBytes }
});

const cryptoManager = new DefaultCryptoManager();
cryptoManager.registerEncrypter('my-encrypter', provider.encrypterForKey('my-key-id'));
cryptoManager.registerDecrypter(provider.decrypter());

const cluster = await couchbase.connect('couchbase://localhost', {
    username: 'username',
    password: 'Password!123',
    cryptoManager,
});
const collection = cluster.bucket('myapp').defaultCollection();

Encrypting Fields on Write

const doc = {
    name: 'Alice',
    ssn: '123-45-6789',
    creditCard: '4111111111111111',
};

await collection.upsert('user::alice', doc, {
    encryptFields: {
        ssn: 'my-encrypter',
        creditCard: 'my-encrypter',
    },
});

Decrypting Fields on Read

const result = await collection.get('user::alice');
// Decryption is automatic when cryptoManager is configured
console.log(result.content.ssn); // "123-45-6789"

Limitations

• Encrypted fields cannot be indexed or queried with SQL++
• Adds ~30% overhead to encrypted field size
• See fle for full concept reference