# Kafka Field-Level Encryption in 5 Minutes

Only some fields in a Kafka record are sensitive. In this demo we encrypt those fields with a Conduktor Gateway interceptor, leave the rest readable, and never touch the client code. We also look at what's actually written to the underlying Kafka topic.

## What You'll Learn

- Configure an interceptor to encrypt named fields on produce, with keys from HashiCorp Vault
- Add a decrypt interceptor so authorized consumers get clear text back on consume
- See what's stored in Kafka: ciphertext plus metadata headers that Gateway strips before consumers see them