# Queryable Encryption prefix, suffix and substring query configuration > Source-anchored research for Queryable Encryption prefix, suffix and substring query configuration. Run status: COMPLETED. Parent: [MongoDB Security Architecture](https://llms-explorer.com/tree/mongodb-security-architecture/) · 4 facets · 20 facts · page: https://llms-explorer.com/tree/queryable-encryption-prefix-suffix-and-substring-query-configuration/ ## How it works - caseSensitive and diacriticSensitive control string matching normalization. The tuning reference requires both settings and requires identical values when multiple query types share a field; setting false enables insensitive matching. The schema tutorial instead calls these settings optional with true defaults. (high confidence) — [source](https://www.mongodb.com/docs/manual/core/queryable-encryption/fundamentals/encrypt-and-query.md) - caseSensitive and diacriticSensitive control string matching normalization. If prefix and suffix share a field, both configurations must use the same sensitivity settings. Set both explicitly because the documentation disagrees about whether they are optional. (high confidence) — [source](https://www.mongodb.com/docs/manual/core/queryable-encryption/qe-create-encryption-schema.md) ## Problems, failure modes and limitations - Configure string fields in encryptedFields.fields with path, bsonType: "string", and queries.queryType set to "prefix", "suffix", or "substring". Prefix and suffix may coexist on one field; substring cannot be combined with another query type on that field. (high confidence) — [source](https://www.mongodb.com/docs/manual/core/queryable-encryption/qe-create-encryption-schema.md) - For GA substring queries, strMaxLength is required and must be 2–50 inclusive; strMinQueryLength must be at least 2; strMaxQueryLength must be 2–6 inclusive. Prefix and suffix query length bounds start at 1. Inserts or queries beyond configured bounds fail. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/core/queryable-encryption/fundamentals/encrypt-and-query.md) - For preview migration, a compatible 9.0 driver can decrypt existing data by reading the whole collection or filtering an unencrypted field. It cannot run preview encrypted-field queries. mongoexport and mongodump do not perform the required decryption. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/release-notes/9.0-compatibility.md) - MongoDB 9.0 does not allow fleDisableSubstringPreviewParameterLimits to override substring bounds. Historical preview limit-override instructions must not be applied to the GA configuration. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/release-notes/9.0-compatibility.md) ## Comparisons and alternatives - The storage guide models worst-case tags per field as 1 + (strMaxQueryLength - strMinQueryLength + 1) for prefix or suffix. At substring limits 2–6 with strMaxLength 50, its example produces 236 tags versus 6 for prefix or suffix. These are upper-bound estimates. (low confidence) — [source](https://www.mongodb.com/docs/manual/core/queryable-encryption/qe-estimate-storage-impact.md) - Choose the smallest useful query-length interval before creating the encrypted collection. Substring indexes generate more search tags than prefix or suffix indexes, and their field-length bound also affects storage. MongoDB recommends substring only when prefix/suffix are insufficient, generally on one field and collections below 50 million documents; these are sizing recommendations rather than stated hard collection limits. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/core/queryable-encryption/fundamentals/encrypt-and-query.md) ## Facts and statements - MongoDB announced general availability of encrypted prefix, suffix and substring queries on September 29, 2026. The 9.0 compatibility notes require MongoDB 9.0 or later and compatible drivers for these GA query types. (high confidence) (verified as of 2026-09-29) — [source](https://www.mongodb.com/products/updates/now-ga-queryable-encryption-prefix-suffix-and-substring-support/) - Prefix, suffix and substring map to $encStrStartsWith, $encStrEndsWith and $encStrContains respectively. $encStrNormalizedEq provides normalized equality matching under the field's string-query configuration. (high confidence) — [source](https://www.mongodb.com/docs/manual/core/queryable-encryption/qe-create-encryption-schema.md) - Choose queryable fields before creating the collection. Changing the queryable encryption schema requires recreating the collection. MongoDB 9.0 GA string queries are incompatible with the 8.2/8.3 preview format; migration requires a new collection and reinserting decrypted data. (high confidence) — [source](https://www.mongodb.com/docs/manual/core/queryable-encryption/fundamentals/encrypt-and-query.md) - The driver specification uses algorithm String with stringOpts and queryType prefix, suffix or substring. The NODE-7537 ticket records the TextPreview-to-String and TextOpts-to-StringOpts renames; its driver update requires libmongocrypt 1.19.1 or later. (high confidence) (verified as of 2026-09-15) — [source](https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/client-side-encryption.md) - The 9.0 compatibility notes remove prefixPreview, suffixPreview and substringPreview and disallow overriding internal substring limits. Older TextQueryOptions documentation explicitly describes an experimental textPreview API, so it should not be treated as the GA configuration contract. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/release-notes/9.0-compatibility.md) - NoSQLBooster's October 26, 2026 release notes describe 11.2 support for all four encrypted string operators, with Pipeline API and $. helper methods and updated encryption connection templates. (low confidence) (verified as of 2026-10-29) — [source](https://www.nosqlbooster.com/blog/announcing-nosqlbooster-11-2/) - The 2015 Chase–Shen paper formalizes queryable encryption and constructs substring search using encrypted suffix trees with explicitly defined access-pattern leakage. This is general research background, not evidence that MongoDB's GA string indexes use that construction or share its guarantees. (low confidence) — [source](https://petsymposium.org/popets/2015/popets-2015-0014.php) - For GA substring indexing, strMaxLength must be 2–50; strMinQueryLength must be at least 2; strMaxQueryLength must be 2–6. Inserts exceeding the configured field length and queries outside configured query lengths return errors. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/core/queryable-encryption/fundamentals/encrypt-and-query.md) - Prefix and suffix configurations require positive strMinQueryLength and strMaxQueryLength values, starting at 1. The substring-specific six-character maximum does not apply to prefix and suffix query lengths. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/core/queryable-encryption/fundamentals/encrypt-and-query.md) - For explicit string encryption, the current driver specification uses algorithm "String" and stringOpts, with prefix, suffix, or substring options and sensitivity flags. stringOpts is rejected for unrelated algorithms. Explicitly encrypted String payloads still require a MongoClient configured with AutoEncryptionOpts and bypassAutoEncryption false for server processing. (low confidence) (verified as of 2026-10-27) — [source](https://github.com/mongodb/specifications/blob/master/source/client-side-encryption/client-side-encryption.md) - MongoDB 9.0 removes prefixPreview, suffixPreview, and substringPreview and replaces the preview text algorithm with the GA string algorithm. Preview collections require a new GA collection and re-encryption; renaming the query type does not migrate their encrypted data. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/manual/release-notes/9.0-compatibility.md) - NoSQLBooster 11.2 adds editor and Pipeline/operator helpers for the four encrypted-string operators and updates its In-Use Encryption template with GA query types and preview migration guidance. This is independent evidence of tool integration, not an independent cryptographic audit. (low confidence) (verified as of 2026-10-29) — [source](https://www.nosqlbooster.com/blog/announcing-nosqlbooster-11-2/)