Where Secrets Belong on a Phone (Keychain and Keystore)

hard

Learn with your AI

Pick a depth. Each prompt opens in your AI pre-loaded with the lesson. Click a row to preview the prompt.

Or teach me the whole lesson:

Why this matters

Mobile apps store secrets — auth tokens, encryption keys, biometric template hashes. Right storage matters: iOS Keychain (hardware-backed on devices with Secure Enclave), Android Keystore (hardware-backed via TEE / StrongBox). Storing secrets in plain UserDefaults / SharedPreferences = secrets readable by anyone with file-system access.

Demo

iOS Keychain: SecItemAdd(['kSecClass': 'kSecClassGenericPassword', 'kSecAttrAccessControl': SecAccessControlCreateWithFlags(.devicePasscode)]). Stored encrypted, requires device passcode to access. Android: KeyStore.getInstance('AndroidKeyStore'), key never leaves StrongBox.

Try it yourself

Switch app secret storage from prefs/UserDefaults to Keychain/Keystore.
Add biometric gating: secret accessible only via Touch/Face ID.
Test: extract the device's data directory. Should not contain plaintext secrets.

Where Secrets Belong on a Phone (Keychain and Keystore)

Why this matters

Demo

Try it yourself

References