What is so cool about the wiredtiger database

2026-05-03 @equalsraf

Wiredtiger is a NoSQL database:

• licensed under the GPL
• written in C with python bindings
• supports encryption at rest if built with libsodium

That last one is what makes it cool. AFAIK not many embedded databases support encryption at rest without extra plugins

• mariadb (embedded) needs third party plugins or only supports reading a key from a file
• sqlite has extensions (but caveat it is easy to accidentally create a non encrypted DB by mistake)
• the other database that has this is DuckDB (but I never used it)

Here is a python example, the encryption is handled with a connection string argument that

• instructs the use of an extension libwiredtiger_sodium.so
• enables encryption using sodium extension
• passes a 32 byte hex encoded secret key
• note the library path may have to be absolute

import os
from wiredtiger import wiredtiger_open

DBPATH = '/tmp/WT_EXAMPLE'
 
# Connect to the database and open a session
os.system(f'rm -rf {DBPATH}')
os.makedirs(DBPATH)
 
conn = wiredtiger_open(DBPATH, 'create,extensions=[libwiredtiger_sodium.so],encryption=(name=sodium,secretkey=b70e537d9067da4745dd62a761b49785dd41b776a651ce8e7acaf9fbd0aa0b07)')
session = conn.open_session()
 
# Create a simple table
session.create('table:T', 'key_format=S,value_format=S')
 
# Open a cursor and insert a record
cursor = session.open_cursor('table:T', None)
 
cursor.set_key('key1')
cursor.set_value('value1')
cursor.insert()
 
# Iterate through the records
cursor.reset()
for key, value in cursor:
    print('Got record: %s : %s' % (key, value))
 
conn.close()

References