Mobile app data storage — Keychain, Keystore

hard

Learn with your AI

Open this lesson in your favourite AI. It'll walk you through the why, explain the demo, and quiz you on the try-it list.

Open in Claude Open in ChatGPT

Why this matters

Mobile apps store secrets — auth tokens, encryption keys, biometric template hashes. Right storage matters: iOS Keychain (hardware-backed on devices with Secure Enclave), Android Keystore (hardware-backed via TEE / StrongBox). Storing secrets in plain UserDefaults / SharedPreferences = secrets readable by anyone with file-system access.

Demo

iOS Keychain: SecItemAdd(['kSecClass': 'kSecClassGenericPassword', 'kSecAttrAccessControl': SecAccessControlCreateWithFlags(.devicePasscode)]). Stored encrypted, requires device passcode to access. Android: KeyStore.getInstance('AndroidKeyStore'), key never leaves StrongBox.

Try it yourself

Switch app secret storage from prefs/UserDefaults to Keychain/Keystore.
Add biometric gating: secret accessible only via Touch/Face ID.
Test: extract the device's data directory. Should not contain plaintext secrets.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain Keychain / Keystore.

2. Why it works (the mechanism)

Walk me through what happens when an app stores a secret in iOS Keychain with biometric protection.

3. Advanced — application & what's next

Design secret management for a multi-platform mobile app.