# Working with encryption

This section describes using encryption in Derby.

- Encrypting databases on creation
  You configure a Derby database for encryption when you create the database by specifying the dataEncryption=true attribute on the connection URL.
- Encrypting an existing unencrypted database
  You can encrypt an unencrypted Derby database by specifying attributes on the connection URL when you boot the database. The attributes that you specify depend on how you want the database encrypted.
- Creating the boot password
  When you encrypt a database you must also specify a boot password, which is an alpha-numeric string used to generate the encryption key.
- Encrypting databases with a new key
  You can apply a new encryption key to a Derby database by specifying a new boot password or a new external key.
- Booting an encrypted database
  If you create an encrypted database using the bootPassword attribute, you must specify the boot password to reboot the database. If you create an encrypted database using the encryptionKey attribute, you must specify the encryptionKey to reboot the database.
- Changing the boot password
  You can change the boot password for the current database.

Parent topic: Encrypting databases on disk
Related concepts
Requirements for Derby encryption