Which Custom Fields Can I Encrypt?

Note This content relates to Shield Platform Encryption. Read about implementing field-level encryption using Shield Extension in Own from Salesforce.

Note This page is about Shield Platform Encryption, not Classic Encryption. What's the difference?

If you configure fields for encryption using FLE when Database Encryption is on, the field encryption happens first.

The custom fields that you select that belong to one of these field types:

• Email
• Phone
• Text
• Text Area
• Text Area (Long)
• Text Area (Rich)
• URL
• Date
• Date/Time

Note To enable encryption on any custom object, you navigate directly to the object in Object Manager

After a custom field is encrypted, you can’t change the field type. For custom phone and email fields, you also can’t change the field format.

Important When you use FLE to encrypt the Name field, enhanced lookups are automatically enabled. Enhanced lookups improve the user’s experience by searching only through records that have been looked up recently, and not all existing records. Switching to enhanced lookups is a one-way change. You can’t go back to standard lookups, even if you disable encryption.

You can’t use Schema Builder to create an encrypted custom field.

To encrypt custom fields that have the Unique or External ID attribute, you can only use deterministic encryption.

To support case-insensitive queries, Salesforce stores a lowercase duplicate of your data as a custom field in the database. These duplicates are necessary for case-insensitive queries, but they count against your total custom field count. For example, if you have 200 custom fields in your org, and you choose to encrypt one with case insensitive deterministic encryption, your custom field total is 201.