# Encrypting databases on creation

You configure a Derby database for encryption when you create the database by specifying attributes on the connection URL.

- To enable encryption, use the `dataEncryption=true` attribute.
- To provide a key for the encryption, specify either the `bootPassword=key` attribute or the `encryptionKey=key` attribute.

The following connection URL specifies a boot password:

    jdbc:derby:encryptedDB;create=true;dataEncryption=true;
    bootPassword=DBpassword

The following URL specifies an encryption key:

    jdbc:derby:encryptedDB;create=true;dataEncryption=true;
    encryptionKey=6162636465666768

The default encryption algorithm is DES.

You can specify an encryption provider and/or encryption algorithm other than the defaults by using the `encryptionProvider=providerName` and `encryptionAlgorithm=algorithm` attributes. See Specifying an alternate encryption provider and Specifying an alternate encryption algorithm for more information.

See the Derby Reference Manual for details on the connection URL attributes.

Parent topic: Working with encryption
Related concepts
Creating a boot password
Booting an encrypted database
Decrypting an encrypted database
Related tasks
Encrypting an existing unencrypted database
Encrypting databases with a new key