Way to see all encrypted fields in Salesforce?

Question

I was looking for a way to see what fields in an org are encrypted. I am aware of the encryption statistics, however I was hoping there was a way where I could do a SOQL query and return all the encrypted fields. If not, I can use the encryption statistics page.

Answer 1

Adding another answer to show how it works through callouts to metadata. This is done, because you cannot retrieve encryptionScheme throught simple Schema methods.

To use this code you need to have MetadataService class from https://github.com/financialforcedev/apex-mdapi/blob/master/apex-mdapi/src/classes/MetadataService.cls

Explanation: first of all I retrieve names of encrypted fields as I have done in the previous answer. However, next thing to do - is call for metadata info from salesforce, where encryptionScheme is populated in the response.

List<String> fullNamesOfEncryptedFields = new List<String>();

for (Schema.SObjectType object_i : Schema.getGlobalDescribe().values()) {
    for (Schema.SObjectField field_i : object_i.getDescribe().fields.getMap().values()) {
        if (field_i.getDescribe().isEncrypted()) {
            fullNamesOfEncryptedFields.add(object_i.getDescribe().getName() + '.' + field_i.getDescribe().getName());
        }
    }
}

MetadataService.MetadataPort service = new MetadataService.MetadataPort();
service.SessionHeader = new MetadataService.SessionHeader_element();
service.SessionHeader.sessionId = UserInfo.getSessionId();
service.CallOptions = new MetadataService.CallOptions_element();
service.timeout_x = 120000;

List<String> batch = new List<String>();
List<MetadataService.CustomField> mdInfo = new List<MetadataService.CustomField>();

for (String fullName_i : fullNamesOfEncryptedFields) {
    batch.add(fullName_i);

    if (batch.size() == 10) { //MAX_BATCH_METADATA_SIZE
        mdInfo.addAll((List<MetadataService.CustomField>) service.readMetadata('CustomField', batch).getRecords());
        batch.clear();
    }
}

if (batch.size() > 0) {
    mdInfo.addAll((List<MetadataService.CustomField>) service.readMetadata('CustomField', batch).getRecords());
}

for (MetadataService.CustomField field_i : mdInfo) {
    system.debug(field_i.fullName + ' ' + field_i.encryptionScheme);
}

Answer 2

It can be done through apex execution, not through SOQL:

for (Schema.SObjectType object_i : Schema.getGlobalDescribe().values()) {
    for (Schema.SObjectField field_i : object_i.getDescribe().fields.getMap().values()) {
        if (field_i.getDescribe().isEncrypted()) {
            system.debug(object_i.getDescribe().name + ': ' + field_i.getDescribe().getName());
        }
    }
}