1. A system, comprising: an encryption manager configured to: receive a query for an encrypted database, generate a query plan from the received query that indicates one or more storage representations of the encrypted database from which to retrieve data, and submit, to the encrypted database, the query plan and a token that includes one or more decryption keys corresponding to the one or more storage representations; and the encrypted database that includes the one more storage representations, wherein the encrypted database is configured to: use the one or more decryption keys to generate partially decrypted data from the indicated one or more storage representations, wherein to use the one or more decryption keys to generate partially decrypted data, the encrypted database is further configured to decrypt a respective outer encryption layer of the indicated one or more storage representations with the one or more decryption keys into corresponding one or more working representations, wherein the one or more working representations include a respective mapping of field values in an property preserving manner without revealing underlying field values, and provide the partially decrypted data to the encryption manager for further decryption operations by a query offload processor.