---
title: "One Stone, Three Birds: Finer-Grained Encryption @ Apache Parquet™"
description: "Apache Parquet modular encryption is presented as a way to unify fine-grained access restriction, column-specific retention, and encryption at rest for large Hadoop-based data platforms. The approach encrypts selected columns with different keys at the Parquet file-format layer while preserving column projection, predicate pushdown, encoding, and compression; schema-controlled encryption avoids extra RPC calls and supports tag-driven policies. The post describes operational challenges including multiple access paths and Parquet versions, hard versus soft denial, KMS reliability, historical backfills, changing schema tags, and mixed data formats, alongside auto-onboarding and a high-throughput tool for existing data. In an evaluation using Java 8, CTR mode, and 60% encrypted columns, encryption added 5.7% to writes and 3.7% to reads, while the tool encrypted data 20 times faster; the changes were merged upstream for Parquet 1.13.0."
---

# One Stone, Three Birds: Finer-Grained Encryption @ Apache Parquet™

[Uber](https://yomu.fyi/company/uber) · May 19, 2026

**Type:** Problem & solution

## Summary

Apache Parquet modular encryption is presented as a way to unify fine-grained access restriction, column-specific retention, and encryption at rest for large Hadoop-based data platforms. The approach encrypts selected columns with different keys at the Parquet file-format layer while preserving column projection, predicate pushdown, encoding, and compression; schema-controlled encryption avoids extra RPC calls and supports tag-driven policies. The post describes operational challenges including multiple access paths and Parquet versions, hard versus soft denial, KMS reliability, historical backfills, changing schema tags, and mixed data formats, alongside auto-onboarding and a high-throughput tool for existing data. In an evaluation using Java 8, CTR mode, and 60% encrypted columns, encryption added 5.7% to writes and 3.7% to reads, while the tool encrypted data 20 times faster; the changes were merged upstream for Parquet 1.13.0.

## Context

Hadoop-based data platforms need finer-grained access restrictions, column-specific retention, and encryption at rest, but implementing them across multiple access routes, Parquet versions, data formats, changing schema tags, historical data, and KMS-backed key management creates performance and reliability challenges.

## Approach / What changed

The solution uses Apache Parquet modular encryption to encrypt selected columns with different keys at the file-format layer. Schema-controlled encryption supports tag-driven policies without extra RPC calls, while auto-onboarding and a high-throughput encryption tool address large-scale adoption and historical data. Null-type masking is used when users lack permission to encrypt data.

## Takeaways

- Parquet modular encryption supports column encryption while retaining columnar projection, predicate pushdown, encoding, and compression.
- Using Java 8, CTR mode, and 60% encrypted columns, the evaluation measured 5.7% write overhead and 3.7% read overhead.
- A high-throughput tool encrypted existing data 20 times faster, and the Parquet changes were merged for release in Parquet 1.13.0.

**Tags:** [Data Governance](https://yomu.fyi/topic/data-governance), [Parquet](https://yomu.fyi/topic/parquet)

- Source: [Uber](https://www.uber.com/us/en/blog/one-stone-three-birds-finer-grained-encryption-apache-parquet)
- Source URL: https://www.uber.com/us/en/blog/one-stone-three-birds-finer-grained-encryption-apache-parquet
- Ingested by Yomu: 2026-09-13T00:02:19.804Z

[Read original post](https://www.uber.com/us/en/blog/one-stone-three-birds-finer-grained-encryption-apache-parquet)