My server is sending me access and a refresh token while logging in. Should I store them in the shared preferences of android by encrypting it? I want to know the best practice for storing these tokens as storing directly into preferences is easily hackable.


Android supports the beautiful concept of Application Sandbox, such that all the application run as a unique user and in its own sandbox. The local data storage in a non-rooted device for non-debuggable applications is normally not accessible. However, if the device is rooted the concept of application sandbox collapses and the installed application can run as a "root" user and can, therefore, access the data stored by any other application in their private directory(/data/data/package-name)

Storing the token as plaintext in the local data storage(SharedPreferences) is not a secure option since the same can be easily accessed from a non-rooted device. It is recommended that the token should be encrypted using secure encryption algorithm and secure implementation in the local data storage.

  1. Use secure encryption algorithm such as AES-GCM-256 or ChaCha20-Poly1305 etc.
  2. Use PBKDF2 for key derivation.
  3. If required store the encryption key in the Android Keystores.
  • Why not just store the auth token in Android Keystore? This seems like the roundabout way of doing it? – Ben Butterworth Oct 23 '20 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.