Skip to content

Secure Storage

Flutter provides a built-in secure storage API via the flutter_secure_storage package, designed for storing sensitive data like API tokens, credentials, or session information. Unlike standard shared preferences, this API encrypts data at rest using AES-256 and leverages platform-specific keychain mechanisms (Android Keystore, iOS Keychain) to protect stored values. It is ideal for scenarios where data confidentiality and integrity are critical, such as authentication workflows or secure user preferences.

Key Concepts of Flutter Secure Storage

The flutter_secure_storage API operates through a SecureStorage class that allows:
- Saving key-value pairs with encryption
- Retrieving encrypted values
- Deleting entries
- Clearing all stored data

Platform-Specific Encryption

  • Android: Uses Android Keystore System to derive encryption keys, ensuring keys are never exposed to app code.
  • iOS: Relies on the iOS Keychain, which is protected by device passcodes and biometric authentication.
  • Web: Not supported (data is stored in-memory, not encrypted).

Basic Usage Example

import 'package:flutter_secure_storage/flutter_secure_storage.dart';

final storage = FlutterSecureStorage();

// Save sensitive data
await storage.write(key: 'auth_token', value: 'your_encrypted_token_here');

// Retrieve data
final token = await storage.read(key: 'auth_token');
print('Retrieved token: $token');

// Delete data
await storage.delete(key: 'auth_token');

Note: The package automatically encrypts values using AES-256, but developers must ensure that sensitive data (e.g., API keys) is never stored in plaintext. Always use this API for tokens, not passwords.

Use Cases for Secure Storage

  1. Authentication Tokens: Store JWTs or OAuth tokens securely after login.
  2. User Credentials: Save encrypted passwords or biometric unlock data.
  3. Session Persistence: Keep session identifiers safe across app restarts.

Avoid: Use secure storage for non-sensitive data (e.g., user preferences) to minimize attack surface.

Best Practices

  • Encrypt Data Before Storage: Never store plaintext secrets; use this API to encrypt values.
  • Scope Access: Limit access to secure storage operations to trusted components.
  • Clear Data on Logout: Explicitly delete tokens or credentials when users sign out.
  • Handle Exceptions: Implement error handling for cases like key mismatches or storage failures.

Limitations and Considerations

  • No Web Support: Secure storage is unavailable on web platforms.
  • Platform-Specific Behavior: Ensure compatibility across Android/iOS by testing key derivation and encryption workflows.
  • No Cross-App Sharing: Data is isolated to your app’s sandbox, so use this API for app-specific secrets only.

Key takeaways

  • Use flutter_secure_storage for encrypting sensitive data like tokens and credentials.
  • Data is encrypted with AES-256 and protected by platform-specific keychains.
  • Avoid storing plaintext secrets; always encrypt values before storage.
  • Clear sensitive data on logout and handle exceptions for secure operations.
  • Secure storage is platform-specific and not available on web.