Using Envers to track only the fact that a column has changed

That’s for clarifying.

I just tested a simple AttributeConverter shown below:

public class EncryptConverter implements AttributeConverter<String, String> {
	@Override
	public String convertToDatabaseColumn(String attribute) {
		return "HELLO";
	}

	@Override
	public String convertToEntityAttribute(String dbData) {
		return "WORLD";
	}
}

paired with the following entity:

@Entity
@Audited
public class User {
	@Id
	@GeneratedValue
	private Integer id;
	private String userName;
	@Convert( converter = EncryptConverter.class )
	private String password;

    // getter and setters omitted for breavity
}

What I observed is that the converted value of HELLO is pushed into both the User data table and audit table entries. So a @Convert annotation should suffice here and the data should be properly handled in the audit tables unless there is a corner case or some other element involved preventing this in your environment if you observe something otherwise.

Here is the example of my Envers test suite methods:

@Test
@Priority(10)
public void initData() {
	this.userId = doInJPA( this::entityManagerFactory, entityManager -> {
		final User user = new User();
		user.setUserName( "admin" );
		user.setPassword( "WORLD" );
		entityManager.persist( user );
		return user.getId();
	} );
}

@Test
public void testJpaConverterAppliedToAuditField() {
	doInJPA( this::entityManagerFactory, entityManager -> {
		final String password = (String) entityManager
				.createNativeQuery( "SELECT password FROM User_AUD WHERE id = :id" )
				.setParameter( "id", this.userId )
				.getSingleResult();
		assertEquals( "HELLO", password );

		final User user = AuditReaderFactory.get( entityManager ).find( User.class, this.userId, 1 );
		assertEquals( "WORLD", user.getPassword() );
	} );
}

Let me know if you have any further questions. I did add JIRA HHH-12237 for the support for tracking only the modified flag field as requested.