How should a mobile app store the user's auth token securely?
asked 4 months ago351 viewsen
In my mobile app I currently save the JWT in AsyncStorage / SharedPreferences. Is that secure enough?
AI diagnosis
AI-generated. Not an answer — the community below confirms or corrects it. Always verify before relying on it.
1 Answer
No. AsyncStorage and SharedPreferences are unencrypted and readable on rooted/jailbroken devices and through some backups. Store tokens in the platform's secure storage instead: iOS Keychain and the Android Keystore-backed encrypted storage.
- Expo / React Native: expo-secure-store or react-native-keychain.
import * as SecureStore from 'expo-secure-store';
await SecureStore.setItemAsync('refresh_token', token);- Flutter: flutter_secure_storage.
Good token design on top of that: - Short-lived access token (minutes), kept in memory where possible, plus a refresh token in secure storage. - Rotate refresh tokens on use, and support server-side revocation ("log out all devices"). - Never put secrets like API keys for third-party services in the app binary. Anything shipped in the app can be extracted. Proxy those calls through your backend.
Sign in to tell others whether this worked.
Sign in and verify your email to post an answer.