I turned on Always Encrypted in sql 2016 and was able to see the column to be crypted. My question is this: can I decrypt this column in sql function without "column encryption setting = Enabled" and use "DecryptByKeyAutoCert" function?

1 Answer 1


The way that Always Encrypted works (without, for example, secure enclaves) is that the client driver does the encryption and decryption (including querying the metadata and finding the proper keys). The keys should not be stored on the database server or accessible by it, otherwise what's the point.

This also means that items such as DecryptByKeyAutoCert will not work as 1) it does not have access to the keys 2) the database engine doesn't do the encryption or decryption, the client driver does. There are other reasons why this also won't work but no point in being pedantic.

If you want to see the decrypted value, make sure you have access to the proper keys and using a client driver that supports the operations, along with the connection string setting you've already specified.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.