# Encrypting databases with a new boot password

You can apply a new boot password to a Derby database by specifying the `newBootPassword=newPassword` attribute on the connection URL when you boot the database.

- If the database is configured with log archival for roll-forward recovery, you must disable log archival and perform a shutdown before you can encrypt the database with a new boot password.
- If any global transactions are in the prepared state after recovery, the database cannot be encrypted with a new boot password.
- If the database is currently encrypted with an external encryption key, use the `newEncryptionKey=key` attribute to encrypt the database.

When you use the `newBootPassword=newPassword` attribute, a new encryption key is generated internally by the engine, and the key is protected using the new boot password. The newly generated encryption key encrypts the database, including the existing data. You cannot change the encryption provider or encryption algorithm when you apply a new boot password.

To encrypt a database with a new boot password:

Specify the `newBootPassword=newPassword` attribute in a URL and reboot the database. For example, if you use the following URL to reboot the `salesdb` database, the database is encrypted with the new encryption key and is protected by the password `new1234xyz`:

    jdbc:derby:salesdb;bootPassword=abc1234xyz;newBootPassword=new1234xyz

If authentication and SQL authorization are both enabled, the credentials of the Database Owner must be supplied as well, since reencryption is a restricted operation.

After you change the boot password, be sure to check for `SQLWarning`s. The change succeeded only if there were no `SQLWarning`s or `SQLException`s.

If you disabled log archival before you applied the new boot password, create a new backup of the database after the database is reconfigured with the new boot password. For more information, see the section "Backing up and restoring databases" in the Derby Server and Administration Guide, particularly "Roll-forward recovery".

Parent topic: Encrypting databases with a new key
Related tasks
Encrypting databases with a new external encryption key