Queryable Encryption: Prefix, Suffix and Substring Queries
Learn how MongoDB Queryable Encryption enables secure, pattern-based searches—such as prefix, suffix, and substring queries—while sensitive string data remains encrypted. Explore how these capabilities extend encrypted search beyond equality matching and support practical use cases for sensitive application data.
Felix Stubner | Senior Curriculum Engineer
Felix Stubner is a Senior Curriculum Engineer on MongoDB’s Education team, where he creates technical learning experiences that make complex systems easier to understand and use. Before joining MongoDB, he worked in customer reliability, developer documentation, AI infrastructure, site reliability, and infrastructure automation. Outside of work, Felix enjoys building experimental tools, playing games, and spending time with his wife and three cats.
Parker Faucher | Senior Curriculum Engineer
Parker Faucher is a Senior Curriculum Engineer on the MongoDB University team, where he designs and develops technical learning content for developers and data professionals. Based in Phoenix, Arizona, Parker specializes in building skills-based learning experiences across topics like vector search, AI applications, and MongoDB performance, helping learners go from concept to hands-on practice.
With a strong focus on quality and efficiency, Parker also leads efforts to integrate AI tooling into the curriculum development workflow, streamlining reviews, accelerating iteration cycles, and freeing up more time for the work that matters most.
Sarah Evans | Senior Curriculum Engineer
Sarah Evans is a Senior Curriculum Engineer at MongoDB, where she designs and develops technical learning experiences for MongoDB University. With a background that bridges curriculum design and hands-on technical expertise, she specializes in translating complex database and data modeling concepts into clear, accessible content for developers and technology professionals. Sarah is passionate about practical, engaging technical education and brings a deep interest in AI-driven development to her work helping learners navigate the intersection of modern databases and intelligent application design.
Imagine an application that stores names, email addresses, and job titles as encrypted data in its MongoDB database.
With Queryable Encryption, the application can query those encrypted field values while they remain encrypted in the database.
Sometimes, the application needs to find an exact value in the encrypted data, such as a specific product name.
That’s known as equality matching, and works well when searching for exact matches.
But what if the application needs to find every name that begins with a known prefix, every email address that ends with a particular domain, or every job title that contains a short term?
In this video, we’ll learn how MongoDB 9.0 makes Queryable Encryption prefix, suffix, and substring searches possible, supporting pattern-based queries while keeping sensitive values encrypted.
Before we look at those pattern matching options, let’s revisit equality matching. With equality matching, the application searches a whole value for an exact match.
For example, if the application searches for Ada Lovelace, it matches only when a field contains this as a complete value. It will not match when it is part of a longer string, such as Mrs. Ada Lovelace, or when it is lowercase.
When the application knows only part of a value, it needs a way to query based on a pattern instead of an exact match.
While equality matching is case-sensitive, case-sensitivity for pattern matching is configurable.
The first of these pattern matching query types is the prefix query, which searches the beginning of an encrypted value.
Suppose three documents in collection each have an encrypted name field where the values are Ada Lovelace, Ada Wong, and Sam Rivera.
Using Ada as the prefix pattern, the query correctly returns Ada Lovelace and Ada Wong, but not Sam Rivera.
On the other hand, a suffix query searches the end of an encrypted value.
Consider another collection of documents, this time containing an encrypted field for email addresses, with the values maya@acme.com, riley@acme.com, and jordan@example.org.
To find every contact at acme.com, we can use @acme.com as the suffix pattern.
Using this, the query correctly returns Maya and Riley’s email addresses, but not Jordan’s.
Finally, let’s look at the substring query which can be used to search for a short pattern anywhere in an encrypted value.
For this query, let’s assume a collection of documents containing an encrypted field for job titles.
Job titles in this field include Engineer, Product Manager, and Director of Engineering,
Using Eng as the substring pattern correctly returns Engineer and Director of Engineering, but not Product Manager.
Awesome job! Let’s take a moment to recap what we learned about pattern-based Queryable Encryption query types.
We learned that prefix queries find encrypted values that begin with a pattern, suffix queries find encrypted values that end with a pattern, and substring queries find encrypted values that contain a short pattern.
Together, these query types, combined with configurable case-sensitivity, offer practical ways to search encrypted values when the whole value is not known.
For implementation details, check out Queryable Encryption in the MongoDB documentation.
